CyberRota Analysis
AI-GeneratedMoguBlog versions up to 6.2 are vulnerable due to inadequate validation of comment author identity in the POST /web/comment/add endpoint, enabling authenticated users to impersonate any other user, including administrators, by manipulating the userUid values in their requests. This flaw poses a medium risk as it can lead to unauthorized actions and potential reputational damage. Organizations using MoguBlog should prioritize addressing this vulnerability to prevent misuse of user accounts and maintain the integrity of their comment system.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.