EUVD-2026-62396
GHSA-5m7r-g86c-vqw2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No authentication or interaction required; integrity impact is on the payment gateway (scope change), not the Joomla host itself; no confidentiality or availability impact applies.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.
AnalysisAI
Payment amount tampering in Balbooa Forms (Joomla extension) versions prior to 2.4.3.2 allows any unauthenticated visitor to purchase priced items for an attacker-controlled amount - including $0.01 - by submitting a crafted value directly to the stripeCharges or payAuthorize payment endpoints. The server forwards this client-supplied total to the payment gateway without recomputing it from configured product prices, and neither endpoint enforces authentication or CSRF checks, making exploitation trivial with a single HTTP request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Balbooa Forms Joomla extension must be installed at a version below 2.4.3.2 with at least one form configured to use Stripe (via the stripeCharges endpoint) or Authorize.net (via the payAuthorize endpoint) for live payment processing, and that form must be published and accessible to unauthenticated visitors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N, score 7.7) accurately captures the risk profile: fully remote, no complexity, no privileges, no interaction, with high integrity impact on the downstream payment system (subsequent system). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Balbooa Forms to version 2.4.3.2 or later, which is the confirmed fix version per the advisory originating from security@joomla.org. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Joomla instances for Balbooa Forms and disable or remove payment-enabled forms from production; notify your payment processor of the vulnerability and request a transaction review for potential fraud. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today