CVE-2021-47930: Unauthenticated SQLi in Balbooa Joomla Forms Builder

title: CVE-2021-47930: Balbooa Forms Builder Unauthenticated SQLi Attempt
id: scw-2026-05-10-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2021-47930, an unauthenticated SQL injection vulnerability in Balbooa Joomla Forms Builder. Attackers send POST requests to the 'com_baforms' component with a malicious 'id' parameter containing JSON, which is then processed by the form submission handler, leading to SQL injection. This rule specifically looks for the vulnerable component path and the presence of the 'id=' parameter in the query string, which are key indicators of this exploit attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-10
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2021-47930/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      uri|contains:
          - '/components/com_baforms/'
      cs-method|exact:
          - 'POST'
      cs-uri-query|contains:
          - 'id='
      # The 'id' parameter is expected to contain JSON, and the SQLi targets a specific key within that JSON.
      # While we can't directly inspect JSON content with these fields, the presence of 'id=' in the query string
      # combined with the component path is a strong indicator for this specific vulnerability.
      # A more advanced rule might look for specific SQL syntax within the 'id' parameter if the log source supported it.
  selection_condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse