| Titel | moxi624 Mogu Blog v2 V4.0 through v5.2; source through 025d78c Cross Site Scripting |
|---|
| Beschreibung | A stored cross-site scripting vulnerability affects moxi624 Mogu Blog v2 releases V4.0, V4.1, V4.2, V4.3, V4.4, V4.5, V5.0, V5.1, v5.2, and current source through commit 025d78c7ac7e19b1abf796fa3cc158d855723d15.
A backend user assigned the blog-category add or edit permission can persist an attacker-controlled BlogSort.sortName value through POST /blogSort/add or POST /blogSort/edit. BlogSortVO applies only a non-empty check. BlogSortServiceImpl.addBlogSort and editBlogSort copy sortName to the BlogSort entity and store it without HTML encoding or an allowlist sanitizer.
The public Freemarker article detail template mogu_web/src/main/resources/templates/info.ftl inserts blog.blogSort.sortName directly into the breadcrumb and category label at lines 43 and 51. An anonymous visitor opening an article that belongs to the affected category causes the stored value to be parsed in the Mogu Blog origin.
The write endpoints are protected by @AuthorityVerify, which derives allowed button URLs from the administrator role. The initialization SQL contains an enabled general administrator role with the blogSort add and edit buttons, and custom roles are supported. Therefore exploitation does not require control of the super-administrator account, and the category editor can be separated from the anonymous victim. This is not self-XSS.
Harmless cross-user triggering was confirmed in an authorized test environment. No executable payload is included. CWE-79. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4).
Product source: https://github.com/moxi624/mogu_blog_v2
Public vendor report: https://gitee.com/moxi159753/mogu_blog_v2/issues/IK5STW
No public record was found for this exact BlogSort.sortName to info.ftl chain. CVE-2022-30517 concerns an upload path. GitHub Issues 114 through 117 concern blog content, search title or summary, and localPictureBaseUrl. This issue uses a different field, write controller, permission buttons, database column, and fix location. |
|---|
| Quelle | ⚠️ https://gitee.com/moxi159753/mogu_blog_v2/issues/IK5STW |
|---|
| Benutzer | JunRoinxxX (UID 100281) |
|---|
| Einreichung | 01.08.2026 12:17 (vor 1 Monat) |
|---|
| Moderieren | 12.09.2026 18:00 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 403153 [moxi624 Mogu Blog v2 bis 5.2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort sortName Cross Site Scripting] |
|---|
| Punkte | 20 |
|---|