CVE-2026-105149: mooSocial all-products sql injection
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as exposed?
mooSocial installations up to version 3.2.4 should be treated as potentially affected if the /stores/all-products endpoint is reachable. The issue is in processing of the rating argument.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated. The attack can be initiated remotely with low attack complexity.
What is the immediate risk if the endpoint is exposed?
An attacker may be able to perform SQL injection through manipulation of the rating argument, with low potential impact to confidentiality, integrity, and availability. Public exploit availability is reported, increasing the likelihood of attempted exploitation.
Is a vendor fix available?
The provided information does not identify a fixed version or vendor remediation. It states that the vendor was contacted but did not respond.