The Balbooa Forms extension for Joomla (versions 1.0.0 to 2.4.3.1) contains an external control of assumed-immutable web parameter vulnerability (CWE-472). Specifically, the stripeCharges and payAuthorize endpoints accept the charge total from client-supplied request parameters and forward these values directly to the payment gateway without recalculating based on the form's configured product prices. These endpoints do not enforce authentication or CSRF checks, allowing unauthenticated attackers to manipulate payment amounts and purchase items for arbitrary prices, including minimal amounts such as $0.01. Attackers can also forge line items, quantities, and shipping information.

An unauthenticated attacker can exploit this vulnerability to purchase products at arbitrary prices, potentially paying far less than the intended amount. This can lead to financial loss for merchants using the affected Balbooa Forms extension. The lack of authentication and CSRF protections on the payment endpoints increases the attack surface and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected payment endpoints or implementing additional access controls and input validation to prevent manipulation of payment parameters. Monitoring for suspicious payment activity is also advisable.