Balbooa Forms for Joomla — Unauthenticated Arbitrary File Upload leading to RCE

#!/usr/bin/env bash
# noisgate: CVE-2026-56291 — Balbooa Forms unauth file upload
# Usage: ./check-baforms.sh <joomla-webroot>
# Optional: SITE_URL=https://site.tld ./check-baforms.sh <webroot>
set -u

ROOT="${1:-}"
if [[ -z "$ROOT" || ! -d "$ROOT" ]]; then
  echo "UNKNOWN: pass Joomla webroot as arg 1" >&2
  exit 2
fi

MANIFEST="$ROOT/administrator/components/com_baforms/baforms.xml"
ALT="$(find "$ROOT" -type f -name 'baforms.xml' 2>/dev/null | head -n1 || true)"
[[ -f "$MANIFEST" ]] || MANIFEST="$ALT"

if [[ -z "$MANIFEST" || ! -f "$MANIFEST" ]]; then
  echo "UNKNOWN: Balbooa Forms not found under $ROOT"
  exit 2
fi

VER=$(grep -oE '<version>[^<]+' "$MANIFEST" | head -n1 | sed 's/<version>//')
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse version from $MANIFEST"
  exit 2
fi

FIXED="2.4.1"
# semver compare: is $VER < $FIXED?
lt() { [ "$1" = "$2" ] && return 1; [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]; }

if lt "$VER" "$FIXED"; then
  STATUS="VULNERABLE"
  RC=1
else
  STATUS="PATCHED"
  RC=0
fi

echo "Balbooa Forms version: $VER  (fixed: $FIXED)"
echo "Manifest: $MANIFEST"
echo "Status: $STATUS"

# Optional live probe for stray webshells in common Balbooa upload dirs
for d in "$ROOT/images/baforms" "$ROOT/media/com_baforms/uploads" "$ROOT/images/com_baforms"; do
  if [[ -d "$d" ]]; then
    HITS=$(find "$d" -type f \( -iname '*.php*' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.pht' -o -iname '*.inc' \) 2>/dev/null)
    if [[ -n "$HITS" ]]; then
      echo "WARNING: executable files present in upload dir $d:"
      echo "$HITS"
      RC=1
    fi
  fi
done

exit $RC