CyberRota Analysis
AI-GeneratedMoguBlog versions up to 6.2 are vulnerable to an authorization bypass in the comment deletion endpoint, allowing attackers to delete any comment and its replies by exploiting improperly validated request-body fields. This flaw poses a significant risk as it can lead to unauthorized content manipulation, affecting the integrity of user-generated content. Organizations using MoguBlog should prioritize patching this vulnerability to safeguard their platforms from potential abuse.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.