Executive brief
The mooSocial Store Plugin, which adds e-commerce capabilities to social networking sites, contains a security flaw that allows unauthorized users to access private database information. By sending specially crafted web requests, an attacker can bypass security controls to extract sensitive data or interfere with the site's operations. This could lead to the exposure of customer information or proprietary business data.
Technical details
A blind SQL injection vulnerability exists in the mooSocial Store Plugin version 2.6 and earlier. The flaw is located in the 'product' URI parameter within the URL rewrite functionality. Because the application fails to properly neutralize special elements used in SQL commands, an unauthenticated remote attacker can utilize boolean-based blind, time-based blind, or stacked query techniques to manipulate database queries. This can be exploited to extract sensitive information from the underlying MySQL database. The vulnerability was addressed in version 2.7 of the plugin.
Affected products
- mooSocial Store Plugin 2.6 and earlier
Timeline
- 2018-08-28: disclosed: Vulnerability discovered by Andrea Bocchetti
- 2018-09-04: other: Exploit code published on Exploit-DB
- 2026-05-25: advisory: NVD/VulnCheck advisory published