Critical security vulnerabilities in BA Gallery Pro 2.5.0

Critical security vulnerabilities in BA Gallery Pro 2.5.0 — RCE, path traversal, arbitrary file operations

Hello Balbooa team,

I'm running BA Gallery Pro 2.5.0 (latest version) on Joomla 5.4.4 and during a security audit of my site I found several critical vulnerabilities in the component. My site was recently compromised with backdoor files, and these vulnerabilities may have been the attack vector.

1. Remote Code Execution via dynamic function call
administrator/components/com_gallery/src/Controller/UploaderController.php, lines ~120-122
$method = $obj->method; is read from the raw POST body (JSON) and then called as a PHP function: $str = $method($data[1]);. An attacker can pass system, exec, or passthru as the method and execute arbitrary OS commands. The same pattern exists in GalleriesController.php lines ~127-128.

2. Arbitrary method invocation via call_user_func()
UploaderController.php, lines ~25-29
The action GET parameter is passed directly to call_user_func(array($uploader, $action)), allowing invocation of any public method on the UploaderHelper object, including destructive ones like multipleDelete().

3. Path traversal / arbitrary file read
UploaderController.php, lines ~143-154
The image GET parameter is concatenated to JPATH_ROOT with no sanitization: $dir = JPATH_ROOT.'/'.urldecode($_GET['image']); — then opened with fopen()/fpassthru(). Directory traversal sequences (../../) allow reading any file on the server.

4. Arbitrary file write
UploaderController.php, savePhotoEditorImage() — the destination path comes from the JSON body with no validation that it stays within the uploads directory. Combined with finding #1, this allows writing webshells anywhere on the server.

5. Arbitrary file/directory deletion
Helper/UploaderHelper.php, multipleDelete() — user-supplied paths are passed directly to unlink() and Folder::delete() with no path validation.

6. No upload file type validation
Helper/UploaderHelper.php, uploadFile() — any file extension is accepted, including .php.

All of these are exploitable by an authenticated administrator, and potentially by remote attackers if combined with any session hijacking or authentication bypass.

Could you please review these findings and let me know if a patch is planned? In the meantime I have disabled the component on my site.

Thank you for your attention.