🖥️ BAForms-RCE — CVE-2026-102425 GUI

Dark-neon GUI scanner/exploit untuk CVE-2026-102425 — Balbooa Forms (com_baforms) 1.0.0–2.4.3.3: Unauthenticated RCE via field shortcode injection pada PHP-after-submission action (eval()).

Standalone GUI implementation — rewritten from scratch based on the mechanism published in the official advisory. Not a wrapper for another party's CLI.

CVE	CVE-2026-102425 (PUBLISHED 2026-09-29, CNA: Joomla! Project)
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-102425
Komponen	com_baforms (Balbooa Forms)
Affected	1.0.0 – 2.4.3.3 (fix ≥ 2.4.3.4)
CWE	CWE-94 (Code Injection)
CVSS 4.0	9.5 Critical — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

---

⚡ Features

• Single URL & Mass list (.txt file, one URL per line)
• Check — detects com_baforms, version from manifest, public forms (loadAjaxForm / embed), exploitable candidates
• Exploit — shortcode breakout field (" ;echo MARKER;//), marker verification, optional uploader drop (up.php) + web-visible verification (shell_url)
• LAB TEST — local mock server that simulates shortcode eval(), 100% safe for payload testing
• Browse… — list file picker via dialog
• Export CSV — all results (check/exploit/lab) to a single CSV file
• hits.txt / exploited.txt — automatic mass output
• Multithreaded + timeout + progress bar + colored log
• Dark neon theme 🟢

📦 Installation

git clone https://github.com/tonydelouvre/CVE-2026-102425
cd CVE-2026-102425
pip install -r requirements.txt
python main.py

Python 3.9+. Windows/Linux/macOS.

🚀 How to Use

1. Run python main.py
2. Enter the target URL (single) or click Browse… for a list file (mass)
3. Choose an action: Check (safe, detection only) or Exploit
4. Not sure the payload works? Click ⚡ LAB TEST — test locally without touching a real host
5. After the scan finishes, click 💾 Export CSV or grab hits.txt / exploited.txt

⚠️ Authorized security testing only. Use only on systems you own or have written permission to test. Misuse is your own legal responsibility.

🧪 Mechanism (brief)

Balbooa Forms allows admins to define PHP that is executed after the form is submitted. That PHP can contain shortcode fields that are replaced with the raw values submitted by the visitor before eval() — without escaping. Exploitable when:

1. Version < 2.4.3.4
2. There is a public form using the PHP-after-submission action
3. The shortcode field is inside a double-quoted PHP string → classic breakout ";echo …;//

CVSS AT:P means the vulnerable configuration (items 2–3) must be present — installing the component alone is not enough.

🩹 Remediation

1. Upgrade Balbooa Forms to 2.4.3.4+
2. Remove PHP-after-submission actions that use shortcode fields/URLs until the patch is installed
3. Enable reCAPTCHA on public forms
4. Audit images/baforms/uploads/, forms, and admin accounts

📚 References

• PoCbit — CVE-2026-102425
• mysites.guru — Balbooa Forms advisories

📄 License

MIT — see LICENSE.