Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
moxi624 MoguBlog
Default version status: unaffected
0 to ≤ 6.2affected
pkg:github/moxi624/mogu_blog_v2References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C04_comment_delete_idor.py ↗
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java ↗
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java ↗
- https://gitee.com/moxi159753/mogu_blog_v2/releases ↗
- https://github.com/moxi624/mogu_blog_v2 ↗
- https://www.vulncheck.com/advisories/mogublog-through-6.2-arbitrary-comment-deletion-via-request-body-ownership-check ↗