Description
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moxi624 | MoguBlog | ≤ 6.2 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code technical-description
- Vulnerable Code technical-description
- VulnCheck Advisory: MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList third-party-advisory