Description
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moxi624 | MoguBlog | ≤ 6.2 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code technical-description
- Vulnerable Code technical-description
- VulnCheck Advisory: MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit third-party-advisory