CVE-2021-47930: Balbooa Forms Builder SQLi Vulnerability

CVE-2021-47930 Overview

CVE-2021-47930 is an unauthenticated SQL injection vulnerability in Balbooa Joomla Forms Builder version 2.0.6. The flaw resides in the form submission handler of the com_baforms component. Remote attackers can send crafted POST requests containing malicious JSON payloads in the id field parameter. The server fails to sanitize this input before incorporating it into SQL queries. Successful exploitation allows attackers to extract sensitive data from the backend database without authentication. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Unauthenticated remote attackers can execute arbitrary SQL queries against the Joomla database, exposing user credentials, session data, and other sensitive records.

Affected Products

• Balbooa Joomla Forms Builder 2.0.6
• Joomla sites running the com_baforms component
• Deployments exposing form submission endpoints to the internet

Discovery Timeline

• 2026-05-10 - CVE-2021-47930 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2021-47930

Vulnerability Analysis

The vulnerability stems from improper input validation in the form submission handler of the Balbooa Forms Builder Joomla extension. The com_baforms component accepts POST requests that include JSON-encoded data. The id field parameter inside this JSON structure is passed directly to a SQL query without proper sanitization or parameterization. Attackers can inject SQL operators, UNION-based payloads, or boolean conditions to manipulate the underlying query. The endpoint requires no authentication, which lowers the exploitation barrier to any network-positioned attacker.

Root Cause

The root cause is concatenation of attacker-controlled input into SQL statements. The component decodes the JSON body, extracts the id value, and includes it in a query without using prepared statements or escaping functions provided by the Joomla database abstraction layer. This pattern matches the classic [CWE-89] SQL injection weakness.

Attack Vector

Exploitation occurs over the network. An attacker sends a single POST request to the Joomla site targeting the com_baforms form submission endpoint. The request body contains a JSON object where the id field carries SQL syntax instead of an integer identifier. The database returns query results in the HTTP response or through inferential side channels such as response timing. See the VulnCheck Advisory on SQL Injection and Exploit-DB #50447 for the published proof-of-concept request structure.

Detection Methods for CVE-2021-47930

Indicators of Compromise

• POST requests to URLs containing option=com_baforms or the Balbooa form submission route
• JSON request bodies where the id parameter contains SQL keywords such as UNION, SELECT, SLEEP, or comment sequences like -- and /*
• Unusual database query errors or extended response latencies on form submission endpoints
• Web server logs showing repeated form submissions from a single source IP within short intervals

Detection Strategies

• Inspect web application firewall logs for SQL metacharacters inside JSON fields submitted to com_baforms endpoints
• Correlate Joomla access logs with database query logs to identify abnormal query patterns originating from form submissions
• Apply signature-based detection on the id field for SQL injection payloads inside JSON request bodies

Monitoring Recommendations

• Enable verbose logging for the Joomla com_baforms component and forward logs to a centralized analytics platform
• Monitor outbound database traffic for unexpected query volumes or result set sizes tied to form submissions
• Alert on HTTP 500 responses from form endpoints, which often indicate failed injection attempts

How to Mitigate CVE-2021-47930

Immediate Actions Required

• Audit all Joomla installations for the presence of the Balbooa Forms Builder extension at version 2.0.6 or earlier
• Restrict access to form submission endpoints using IP allowlists or authentication where business requirements permit
• Deploy WAF rules that block SQL metacharacters inside JSON fields submitted to com_baforms
• Review database audit logs for evidence of prior exploitation since the publication of Exploit-DB #50447

Patch Information

Consult the Balbooa Official Website for the latest version of Forms Builder and apply any vendor-supplied updates that address the SQL injection in the com_baforms component. If a patched version is not available, remove or disable the extension until a fix is released.

Workarounds

• Disable the Balbooa Forms Builder extension within the Joomla administrator interface until patched
• Place the affected site behind a web application firewall with rules that reject SQL syntax in JSON request bodies
• Restrict database account privileges used by Joomla to the minimum required, limiting the impact of successful injection
• Implement input validation at the reverse proxy layer to reject non-numeric values in the id field