Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms

githubexploit · 2026-07-18

Description

Exploit for an unrestricted file upload vulnerability in Balbooa Forms.

Entry point

Parameterfile · request body

Pathindex.php?option=com_baforms&task=form.uploadAttachmentFile&form_id=1&format=json

Unauthenticated file upload leading to remote code execution via form.uploadAttachmentFile.

Affected Balbooa Forms versions

Balbooa Forms< 2.4.1

All known vulnerabilities by product

CVSS 10.0 for CVE-2026-56291

10.0

HIGH SEVERITY

Version 4.0

VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H/E:A/AU:Y/U:Red

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

Working code

88%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

14.6%higher than 96.4% of all CVEs

Updated 2026-09-02

Exploit Details

Modified:2026-07-18 22:12

Last Seen:2026-07-18 22:19

Reporter:ChiefYoru

Written in:Python

Last commit:2026-07-18

Tags

Balbooa FormsUnrestricted uploadDangerous file typeSecurity vulnerability

Other exploits for CVE-2026-56291

CVE-2026-56291_PoC

2026-08-31 KitPloitKITPLOIT

2026-08-31 KitPloitKITPLOIT

CVE-2026-56291.yaml

2026-08-31 KitPloitKITPLOIT

2026-08-31 KitPloitKITPLOIT

Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms

2026-07-13 0xdenis77GITHUB

Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms

2026-07-13 0xdenis77GITHUB

Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms

2026-07-13 rimbadirgantaraGITHUB

Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms

2026-07-11 shinthinkGITHUB

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=50A89D7B-D34B-5242-A28B-F172C28091A6
The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.