Executive brief
The MOGG web simulator, a tool used for simulating Magic: The Gathering games online, contains a security flaw in its database handling. An unauthorized attacker can use this flaw to access the underlying database without a password. This could lead to the theft of sensitive user information, including usernames and other private data stored within the application.
Technical details
An SQL injection vulnerability exists in the MOGG web simulator (MTGAS) script due to improper neutralization of special elements in the 'id' parameter of the play.php component. An unauthenticated remote attacker can exploit this by sending specially crafted GET requests containing malicious SQL payloads. Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to the extraction of sensitive database information such as usernames and system data. The vulnerability affects all versions of the script, and public exploit code has been available since 2018.
Affected products
- spider312 MOGG web simulator Script (MTGAS) All versions
Timeline
- 2018-10-29: disclosed: Initial exploit published on Exploit-DB
- 2026-05-30: advisory: CVE published and NVD record created