External Service Interaction Vulnerability in mooSocial by AhriXia
CVE-2023-43323

6.5MEDIUM

Key Information:

Vendor

Moosocial

Status
Moosocial
Vendor
CVE Published:
28 September 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 80%

What is CVE-2023-43323?

mooSocial version 3.1.8 is susceptible to a vulnerability that enables unauthorized external service interactions via the post function. When triggered, this flaw allows the server to issue HTTP and DNS requests to an external server, potentially exposing sensitive information. The affected parameters include messageText, data[wall_photo], data[userShareVideo], and data[userShareLink], thereby increasing the risk of data leakage and unauthorized access to information.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-43323
Created by ahrixia

References

https://github.com/ahrixia/CVE-2023-43323

EPSS Score

80% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.