CVE-2026-105149: SQL Injection in mooSocial

mooSocial versions 3.2.0 to 3.2.4 contain a SQL injection vulnerability in the handling of the 'rating' parameter in the /stores/all-products file. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, but the vendor has not issued any fix or advisory.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score and vector, with limited confidentiality, integrity, and availability impacts. No known active exploitation in the wild has been reported.

No official patch or vendor advisory is available. Since the vendor did not respond and no fix is published, users should consider mitigating exposure by restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'rating' parameter, or temporarily disabling the affected functionality if feasible. Monitor for updates from the vendor for an official fix.