Description
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
moxi624 MoguBlog
Default version status: unaffected
0 to ≤ 6.2affected
pkg:github/moxi624/mogu_blog_v2References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C12_comment_add_author_spoof.py ↗
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java ↗
- https://gitee.com/moxi159753/mogu_blog_v2/releases ↗
- https://github.com/moxi624/mogu_blog_v2 ↗
- https://www.vulncheck.com/advisories/mogublog-through-6.2-comment-author-spoofing-via-request-body-identity ↗