CVE-2026-67363 in Forms Extension
Summary
by MITRE • 08/19/2026
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Balbooa Forms versions prior to 2.4.3.2 represents a critical failure in server-side validation of financial transactions within the Joomla content management system ecosystem. This flaw specifically affects the stripeCharges and payAuthorize endpoints, which are responsible for processing payments through Stripe integration. The core technical issue stems from the application's reliance on client-supplied data to determine transaction values rather than deriving these figures from trusted internal state or database records. When a user initiates a purchase, the frontend sends request parameters containing the desired charge total, line item details, quantities, and shipping costs. Instead of validating this information against the configured product prices stored in the system's backend configuration, the application blindly accepts the client-provided amount and forwards it directly to the payment gateway for processing. This architectural decision effectively shifts the responsibility of price integrity from the server to the untrusted client environment, creating a severe trust boundary violation that allows malicious actors to manipulate financial outcomes at will.
From an operational perspective, this vulnerability enables pre-authentication attackers to execute arbitrary code execution in terms of business logic abuse without needing valid user credentials or session tokens. Since neither endpoint enforces authentication mechanisms nor implements Cross-Site Request Forgery (CSRF) protections such as anti-CSRF tokens or SameSite cookie attributes, the attack vector is exceptionally accessible. An attacker can craft simple HTTP requests to manipulate the charge total, allowing them to purchase high-value items for negligible amounts like $0.01 or even zero dollars if the gateway permits it under specific conditions. Furthermore, beyond price manipulation, the lack of input validation on line item structures allows attackers to forge product details and shipping information. This capability not only results in direct financial loss through unpaid goods but also complicates order fulfillment and inventory management by introducing fraudulent entries into the system's transaction logs.
This vulnerability aligns with several well-known industry standards for software security flaws. It is a classic example of CWE-20 Improper Input Validation, as the application fails to verify that incoming data conforms to expected formats or values derived from trusted sources. More critically, it exemplifies CWE-862 Missing Authorization because unauthenticated users can access functionality restricted to authenticated transactions or specific business roles. The manipulation of financial parameters also falls under CWE-345 Insufficient Verification of Data Authenticity and CWE-913 Improper Control of Dynamically-Managed Resources Identification if the forged items lead to resource exhaustion or misallocation. In terms of offensive security frameworks, this attack maps directly to MITRE ATT&CK technique T1190 Exploit Public-Facing Application, where an attacker leverages a vulnerability in internet-facing software to compromise business logic and financial integrity.
To mitigate this risk, immediate action is required by upgrading the Balbooa Forms extension to version 2.4.3.2 or later, which presumably addresses these validation gaps. In the interim, administrators should implement server-side price verification where all transaction totals are recalculated based on current product prices and configurations stored in the database before being sent to any payment gateway. Additionally, enforcing strict authentication checks on all financial endpoints is essential to ensure that only verified users can initiate purchases. Implementing robust CSRF protection mechanisms, such as synchronizer tokens or SameSite cookie attributes, will prevent unauthorized cross-site requests from manipulating these sensitive operations. Finally, integrating comprehensive input validation and sanitization routines for line items and shipping data ensures that forged payloads are rejected before they impact business logic or financial records.