mooSocial CVE-2026-105149

The vulnerable code path is the /stores/all-products page (the store/marketplace feature of mooSocial), reached by manipulating the 'rating' request argument; this implies the store/products functionality must be deployed and reachable for the endpoint to be exploitable. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no special attack requirements, and no user interaction are needed, so exploitation works remotely against a default-reachable store page. The primary limiting factors are that the instance must expose this store endpoint to the attacker (internet-facing or network-reachable) and must be running mooSocial version 3.2.4 or earlier; no non-default configuration is documented as required.

This is a moderate-risk, not top-priority, issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction, which normally signals an easy-to-hit flaw; however, the impact metrics are all rated Low (VC:L/VI:L/VA:L) rather than High, keeping the base score at 6.9 (Medium) despite the open attack surface. The E:P (Proof-of-Concept) exploit-maturity value, combined with the description's statement that an exploit has been publicly released, means publicly available exploit code exists - but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The signals are therefore internally consistent: easy to reach but limited technical impact, with a public PoC but no confirmed in-the-wild use. One caveat to verify: a CWE-89 SQL injection reachable without authentication would frequently warrant High confidentiality impact (database disclosure), yet the vendor scored confidentiality only Low - this impact rating should be verified against the actual PoC, as it may understate data-exposure risk. Net assessment: patch in a normal cycle and prioritize if mooSocial is internet-facing, but this is not a drop-everything emergency.

A remote, unauthenticated attacker sends a crafted request to the /stores/all-products endpoint with a malicious value in the 'rating' parameter, injecting SQL that the backend executes against the database. Because a public proof-of-concept exploit has been released, low-skill attackers can replicate the attack directly; realistic outcomes include limited extraction or manipulation of database contents consistent with the Low confidentiality/integrity impact rated for this flaw.