Description
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moxi624 | MoguBlog | ≤ 6.2 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code technical-description
- Vulnerable Code technical-description
- VulnCheck Advisory: MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files third-party-advisory