CVE-2026-105149 in mooSocial
Summary
by MITRE • 10/04/2026
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified within mooSocial versions up to 3.2.4 represents a critical security flaw located specifically in the processing logic of the /stores/all-products endpoint. This component is responsible for handling product listings and associated metadata, including user-generated ratings. The core technical deficiency lies in how the application processes the rating argument passed through this interface. Instead of employing parameterized queries or rigorous input sanitization techniques to isolate data from executable code, the software directly incorporates the unvalidated rating value into a SQL query structure. This architectural oversight creates an opportunity for SQL injection attacks, allowing malicious actors to interfere with database operations by injecting custom SQL commands through the rating parameter.
From an operational perspective, this vulnerability is particularly severe because it can be exploited remotely without requiring any form of authentication or prior user interaction beyond accessing the specific endpoint. The absence of access controls means that any internet-connected entity can attempt to exploit this flaw. The impact of a successful exploitation extends far beyond simple data leakage; attackers can potentially extract sensitive information from the underlying database, modify existing records, or even execute administrative commands depending on the privileges assigned to the database user account running the application. This level of access compromise undermines the integrity and confidentiality of the entire platform's data infrastructure.
The situation is exacerbated by the fact that an exploit for this vulnerability has already been released publicly. The availability of ready-made attack tools significantly lowers the barrier to entry for threat actors, increasing the likelihood of automated scanning and widespread exploitation across vulnerable instances. Furthermore, the vendor's lack of response to early disclosure attempts indicates a potential gap in their security patching process or incident management protocol. This delay leaves users exposed to active threats while awaiting an official fix, highlighting the importance of proactive vulnerability monitoring and independent mitigation strategies for administrators relying on this software.
In terms of industry classification standards, this flaw aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attack vector falls under MITRE ATT&CK technique T1190, Exploit Public-Facing Application, as it targets a service accessible over the network to gain unauthorized access or execute malicious code. To mitigate this risk immediately, administrators should implement web application firewall rules that detect and block common SQL injection patterns within query parameters, particularly targeting the rating field in product-related endpoints. Additionally, applying input validation constraints such as strict type checking for numeric values can prevent non-numeric characters from being processed by the backend logic until a patched version of mooSocial is available and deployed.