CVE-2023-44813

CVE-2023-44813 mooSocial v3.1.8 の Invite Friend 機能における mode パラメータに存在する反射型クロスサイトスクリプティング XSS の脆弱性。攻撃者は細工した URL を介してユーザーのセッション Cookie を窃取し、そのアカウントになりすますことができます。 脆弱なパラメータ: mode エクスプロイト - 概念実証 POC 反射型クロスサイトスクリプティング XSS Payload : ';alert1// FINAL Payload URL encoded : %27%3balert1%2f%2f...

CVE-2023-43325

mooSocial: XSS CVE-2023-43325 mooSocial v3.1.8의 사용자 로그인 기능에 있는 dataredirecturl 매개변수에 반사형 사이트 간 스크립팅XSS 취약점이 존재하며, 이를 통해 공격자는 조작된 URL로 사용자의 세션 쿠키를 탈취하고 계정을 가장할 수 있습니다. 취약한 매개변수: dataredirecturl 익스플로잇 - 개념 증명POC 반사형 사이트 간 스크립팅XSS Payload : test"test Payload Base64 encoded :...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 mooSocial v3.1.8의 여러 URL에 반사형 XSS 취약점이 존재합니다. 이 취약점을 통해 공격자는 조작된 URL을 사용하여 사용자의 세션 쿠키를 탈취하고 계정을 가장할 수 있습니다. 참고: 이러한 URL이 Referer 헤더에 사용될 때도 XSS가 작동합니다. 아래에 몇 가지 예가 있으며, 아래와 같은 URL 중 더 많은 취약점이 있을 수 있습니다. 익스플로잇 - 개념 증명 PoC 반사형 XSS Payload : ahrixia"ahrixia Payload Url...

CVE-2023-43323

mooSocial: 外部HTTPおよびDNSサービスとの連携 CVE-2023-43323 mooSocial v3.1.8は、投稿機能において外部サービスとの連携に対して脆弱です。実行されると、サーバーは外部サーバーにHTTPおよびDNSリクエストを送信します。 脆弱なパラメーター: messageText 、datawallphoto 、datauserShareVideo 、datauserShareLink エクスプロイト - 概念実証 POC 外部HTTPおよびDNSサービスとの連携 ペイロード: http://attacker.com/?null=...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43326 info: name: MooSocial 3.1.8 - Cross-Site Scripting author: r3Y3r53 severity:...

mooSocial v.3.1.8 - Cross-Site Scripting

A cross-site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code by sending a crafted payload to the adminredirecturl parameter of the user login function. id: CVE-2023-44812 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha...

CVE-2023-40868

CVE-2023-40868 mooSocial MooSocial Software v.Demo의 CSRFCross Site Request Forgery 취약점으로, 원격 공격자가 Delete Account 및 Deactivate 기능을 통해 임의 코드를 실행할 수 있습니다. 이 취약점은 mooSocial MooSocial Software v.Demo 애플리케이션의 CSRFCross-Site Request Forgery 취약점입니다. CSRF 취약점은 악의적인 공격자가 피해자를 속여 의도하지 않은 작업을 수행하게 할 때 발생합니다....

CVE-2023-40869

CVE-2023-40869 mooSocial Software v.3.1.6 및 3.1.7의 XSSCross Site Scripting 취약점으로 인해 원격 공격자가 editmenu, copuon, groupcategorias 함수에 조작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. CSRF를 통한 저장형 XSS. 영향을 받는 경로 http://admin-socialcommerce.moosocial.com/admin/group/groupcategories...

CVE-2023-44812

CVE-2023-44812 mooSocial v3.1.8의 사용자 로그인 기능에서 adminredirecturl 매개변수에 반사형 크로스 사이트 스크립팅XSS 취약점이 존재합니다. 이 취약점을 통해 공격자는 조작된 URL을 통해 관리자의 세션 쿠키를 탈취하고 해당 계정을 사칭할 수 있습니다. 취약한 매개변수: adminredirecturl 익스플로잇 - 개념 증명POC 반사형 크로스 사이트 스크립팅XSS Payload : "alert1 FINAL Payload URL encoded :...

CVE-2023-45542

CVE-2023-45542 mooSocial v3.1.8 の検索機能の q パラメータに反射型クロスサイトスクリプティング（XSS）の脆弱性が存在します。攻撃者は巧妙に細工された URL を介して、ユーザーのセッション Cookie を窃取し、そのアカウントになりすますことができます。 脆弱なパラメータ: q エクスプロイト - 概念実証（POC） 反射型クロスサイトスクリプティング（XSS） Payload : test"alert1test FINAL Payload URL encoded :...

EUVD-2026-92095

A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public a...

CVE-2026-105149

A security flaw exists in mooSocial versions up to 3.2.4 due to improper processing of the /stores/all-products file. An attacker can perform a remote SQL injection by manipulating the rating argument. Public exploit code is available for this vulnerability. The vendor has not responded to disclo...

CVE-2023-44811

CVE-2023-44811 mooSocial v3.1.8 にはクロスサイトリクエストフォージェリ CSRF の脆弱性があり、認証済みの管理者ユーザーが悪意を持って作成された HTML ページをクリックすると、攻撃者が管理者パスワードを変更できる可能性があります。 認証済みの管理者ユーザーがクリックするとパスワードが変更される 2 つの HTML ページを提供しています。...

mooSocial 3.1.6 - Reflected Cross Site Scripting

A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. id: CVE-2023-4174 info: name: mooSocial 3.1.6 - Reflected Cros...

MooDating 1.2 - Cross-site scripting

A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2. This issue affects some unknown processing of the file /users/view of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. id: CVE-2023-3848...

mooSocial 3.1.8 - External Service Interaction

mooSocial 3.1.8 is vulnerable to external service interaction via multiple parameters in the post function. id: CVE-2023-43323 info: name: mooSocial 3.1.8 - External Service Interaction author: ritikchaddha severity: medium description: | mooSocial 3.1.8 is vulnerable to external service...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-45542 info: name: MooSocial 3.1.8 - Cross-Site Scripting author...

MooDating 1.2 - Cross-Site scripting

A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. id: CVE-2023-3847 info: name: MooDating 1....

mooDating 1.2 - Cross-site scripting

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. id: CVE-2023-3849 info:...

MooDating 1.2 - Cross-Site Scripting

A vulnerability classified as problematic has been found in mooSocial mooDating 1.2. This affects an unknown part of the file /pages of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. id: CVE-2023-3846 info: name: MooDatin...