Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moxi624 | MoguBlog | ≤ 6.2 | — |
References
- C13 - POST /pictureSort/getPictureSortByUid proof of concept exploit
- PictureSortRestApi.getPictureSortByUid is the only method in the controller without @AuthorityVerify technical-description
- MoguBlog releases release-notes
- Product product
- VulnCheck Advisory: MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint third-party-advisory