CVE-2026-89264
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
Debolezza
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
Riferimenti
- https://gitee.com/moxi159753/mogu_blog_v2/releases
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C12_comment_add_author_spoof.py
- https://github.com/moxi624/mogu_blog_v2
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java
- https://www.vulncheck.com/advisories/mogublog-through-6.2-comment-author-spoofing-via-request-body-identity
Trova il bug prima di un attaccante.
Accedi con GitHub e avvia il tuo primo audit in meno di un minuto. Il piano gratuito non richiede carta di credito.