Mogublog
Monthly
Unauthenticated arbitrary comment deletion in MoguBlog through 6.2 allows remote attackers to permanently remove any comment or reply thread on the platform without credentials. The comment delete endpoint (CommentRestApi.java) validates ownership by comparing attacker-supplied authorUid/ownerUid values from the HTTP request body against stored records - a CWE-639 IDOR - instead of checking against the server-side authenticated session principal. Because public unauthenticated listing endpoints expose the comment and author UIDs needed to construct a valid forged request, an attacker can fully enumerate targets and destroy comments at will. A public Python PoC is available via VulnCheck.
Unauthenticated XML external entity injection in MoguBlog through version 6.2 allows remote attackers to read arbitrary files from the server filesystem and trigger outbound SSRF requests via the public WeChat callback endpoint. The WechatRestApi.index() method passes raw POST body XML directly to SignUtil.xmlToMap(), which instantiates a dom4j SAXReader without any DTD or external-entity restrictions, enabling full XXE exploitation with entity resolution reflected in error responses. A publicly available Python proof-of-concept exploit exists; no vendor-released patch has been confirmed at time of analysis.
Missing authorization on a MoguBlog admin-backend endpoint allows authenticated back-office users to retrieve image-category records beyond their assigned role permissions. The POST /pictureSort/getPictureSortByUid handler in versions through 6.2 omits the @AuthorityVerify annotation that enforces role-based access control, making it a classic Broken Function Level Authorization (BFLA) flaw. Impact is limited to confidentiality of image-category metadata (names, cover UIDs, sort order, timestamps); a publicly available Python POC confirms exploitability.
Comment author spoofing in MoguBlog through version 6.2 allows any authenticated user to post comments attributed to arbitrary accounts - including administrators - by supplying an attacker-controlled userUid value in the POST /web/comment/add request body. The server performs no server-side validation that the submitted userUid matches the authenticated session identity, making this a classic IDOR (Insecure Direct Object Reference) flaw under CWE-639. A public proof-of-concept exploit script is available via VulnCheck and GitHub, lowering the bar for abuse; no patched release has been confirmed in the referenced advisories.
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply notifications for arbitrary users by invoking the unprotected /web/comment/closeEmailNotification REST endpoint. The root cause is a missing authentication gate in WebSecurityConfig.java, which permits the endpoint to be reached without a session or credentials, directly writing a suppression flag into the Redis-backed user cache. A publicly available proof-of-concept exploit script exists, lowering the bar for mass or targeted abuse; no patch version has been identified at time of analysis.
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier.
Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories via the /networkDisk/unzipFile endpoint. The vulnerability exists in the FileOperation.unzip function processing the fileUrl argument without proper sanitization, enabling ZIP slip-style extraction. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV; the EPSS probability is low (0.15%).
Unrestricted file upload in Mogu Blog v2 up to version 5.2 allows remote attackers with low privileges to upload arbitrary files via the /file/pictures endpoint by manipulating the filedatas argument. A public proof-of-concept exploit is available, but no active exploitation has been confirmed by CISA KEV. The EPSS exploitation probability is 0.05%, indicating low likelihood of widespread exploitation.
Server-side request forgery in Mogu Blog v2 up to version 5.2 allows remote, unauthenticated attackers to force the server to issue arbitrary HTTP requests via the uploadPictureByUrl function in the /file/uploadPicsByUrl endpoint. Publicly available exploit code
Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated remote attackers to access or manipulate files in the /storage/ directory. The attack complexity is high and a publicly available exploit exists, though no active exploitation is confirmed and EPSS indicates very low likelihood of exploitation.
A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated arbitrary comment deletion in MoguBlog through 6.2 allows remote attackers to permanently remove any comment or reply thread on the platform without credentials. The comment delete endpoint (CommentRestApi.java) validates ownership by comparing attacker-supplied authorUid/ownerUid values from the HTTP request body against stored records - a CWE-639 IDOR - instead of checking against the server-side authenticated session principal. Because public unauthenticated listing endpoints expose the comment and author UIDs needed to construct a valid forged request, an attacker can fully enumerate targets and destroy comments at will. A public Python PoC is available via VulnCheck.
Unauthenticated XML external entity injection in MoguBlog through version 6.2 allows remote attackers to read arbitrary files from the server filesystem and trigger outbound SSRF requests via the public WeChat callback endpoint. The WechatRestApi.index() method passes raw POST body XML directly to SignUtil.xmlToMap(), which instantiates a dom4j SAXReader without any DTD or external-entity restrictions, enabling full XXE exploitation with entity resolution reflected in error responses. A publicly available Python proof-of-concept exploit exists; no vendor-released patch has been confirmed at time of analysis.
Missing authorization on a MoguBlog admin-backend endpoint allows authenticated back-office users to retrieve image-category records beyond their assigned role permissions. The POST /pictureSort/getPictureSortByUid handler in versions through 6.2 omits the @AuthorityVerify annotation that enforces role-based access control, making it a classic Broken Function Level Authorization (BFLA) flaw. Impact is limited to confidentiality of image-category metadata (names, cover UIDs, sort order, timestamps); a publicly available Python POC confirms exploitability.
Comment author spoofing in MoguBlog through version 6.2 allows any authenticated user to post comments attributed to arbitrary accounts - including administrators - by supplying an attacker-controlled userUid value in the POST /web/comment/add request body. The server performs no server-side validation that the submitted userUid matches the authenticated session identity, making this a classic IDOR (Insecure Direct Object Reference) flaw under CWE-639. A public proof-of-concept exploit script is available via VulnCheck and GitHub, lowering the bar for abuse; no patched release has been confirmed in the referenced advisories.
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply notifications for arbitrary users by invoking the unprotected /web/comment/closeEmailNotification REST endpoint. The root cause is a missing authentication gate in WebSecurityConfig.java, which permits the endpoint to be reached without a session or credentials, directly writing a suppression flag into the Redis-backed user cache. A publicly available proof-of-concept exploit script exists, lowering the bar for mass or targeted abuse; no patch version has been identified at time of analysis.
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier.
Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories via the /networkDisk/unzipFile endpoint. The vulnerability exists in the FileOperation.unzip function processing the fileUrl argument without proper sanitization, enabling ZIP slip-style extraction. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV; the EPSS probability is low (0.15%).
Unrestricted file upload in Mogu Blog v2 up to version 5.2 allows remote attackers with low privileges to upload arbitrary files via the /file/pictures endpoint by manipulating the filedatas argument. A public proof-of-concept exploit is available, but no active exploitation has been confirmed by CISA KEV. The EPSS exploitation probability is 0.05%, indicating low likelihood of widespread exploitation.
Server-side request forgery in Mogu Blog v2 up to version 5.2 allows remote, unauthenticated attackers to force the server to issue arbitrary HTTP requests via the uploadPictureByUrl function in the /file/uploadPicsByUrl endpoint. Publicly available exploit code
Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated remote attackers to access or manipulate files in the /storage/ directory. The attack complexity is high and a publicly available exploit exists, though no active exploitation is confirmed and EPSS indicates very low likelihood of exploitation.
A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.