Balbooa Gallery (com_bagallery) 1.0.0 to 2.4.0 - Authenticated Stored XSS

Balbooa Gallery versions 1.0.0 through 2.4.0 allow privileged users to store malicious scripts in gallery items. The injected payload is saved by the component and executed in the browser of any user who later views the affected gallery, so a lower-privileged content author can escalate against an administrator. Fixed in 2.4.1 (released 5 June 2025), whose changelog records a "Cross-Site Scripting (XSS) web security vulnerability" fix. Update to 2.4.1 or later; 2.5.0 adds Joomla 6 compatibility. Note this is the Gallery component - the separate Balbooa Forms flaw is covered by its own rule. Also folded into this rule: CVE-2023-23757 (CVSS 3.1 9.8 CRITICAL), an unauthenticated SQL injection the Joomla CNA records against "BA Gallery" 1.0.0-1.2.0, attributed to bestaddon.com rather than Balbooa. That range sits entirely inside this rule's 1.0.0 to 2.4.0 window and prod carries com_bagallery installs at 1.2, so any affected install is already flagged either way. Recorded here so the CVE does not resurface as new on the next NVD sync.

How severe CVE-2023-23757 is

The published CVE record has no CVSS score, so there is no vector to break down here. mySites.guru rates it Medium, and that is the rating your sites are checked against.

Timeline

1. 7 August 2023CVE-2023-23757 record published by its CNA
2. 18 July 2025mySites.guru check added for Balbooa Gallery (from 1.0.0 up to and including 2.4.0)

Rule details

Other vulnerabilities in Balbooa Gallery

Updating for CVE-2023-23757 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2023-23757 on cve.org (the official CVE record)
• CVE-2023-23757 in the NIST National Vulnerability Database
• balbooa.com/gallery-changelog