Description
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moxi624 | MoguBlog | ≤ 6.2 | — |
References
- C12 - POST /web/comment/add proof of concept exploit
- CommentRestApi.add persists the author uid taken from the request body technical-description
- MoguBlog releases release-notes
- Product product
- VulnCheck Advisory: MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity third-party-advisory