Description

A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resources/templates/info.ftl of the component blogSort Endpoint. The manipulation of the argument sortName results in cross site scripting. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T17:16:56.773Z",
  "pubdate": "2026-09-13T17:16:56.773Z",
  "executiveSummary": "Mogu Blog versions up to 5.2 are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability located in the blogSort component.\nThe vulnerability originates from the improper neutralization of input within the BlogSortServiceImpl.addBlogSort function.\nBy manipulating the sortName parameter, a remote, unauthenticated attacker can inject malicious client-side scripts into the application's persistent storage.\nThese scripts are subsequently executed within the context of the victim's browser when they access the affected endpoint, leading to potential session hijacking, unauthorized actions performed on behalf of the user, or unauthorized information disclosure.\nGiven that the project maintainers have not yet addressed the reported issue, the application remains at significant risk of exploitation. The vulnerability is externally exploitable, requiring no special user interaction beyond navigating to the compromised resource once the malicious payload has been successfully stored.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw affecting the 'blogSort' functionality of Mogu Blog v2 up to version 5.2.\nThe root cause of this vulnerability lies in the lack of adequate input validation and output encoding within the 'BlogSortServiceImpl.addBlogSort' method. Specifically, the 'sortName' argument is processed and subsequently persisted to the database without appropriate sanitization to remove or escape executable script content.\nThe attack flow begins when an attacker sends a specially crafted HTTP request to the vulnerable endpoint associated with adding a blog sort. The attacker provides a malicious payload, typically consisting of JavaScript embedded within HTML tags (e.g., <script>alert(document.cookie)</script>), as the value for the 'sortName' parameter.\nBecause the application logic does not implement necessary character filtering or encoding, the malicious payload is stored verbatim in the underlying database. When other users or administrators visit the page rendered by 'mogu_web/src/main/resources/templates/info.ftl', the application retrieves the unsanitized 'sortName' value and renders it directly into the HTML response.\nThe victim's web browser interprets this input as active content rather than plain text, causing the injected script to execute within the victim's session. This allows for the manipulation of the Document Object Model (DOM), the theft of session cookies or authentication tokens, and the potential for redirecting users to malicious external domains.\nSince the input is persisted, this is categorized as Stored XSS, which is more severe than Reflected XSS as it does not require a victim to click a specially crafted link, but rather affects any user who views the page where the injected 'sortName' is displayed.\nThere are no specific authentication requirements mentioned for triggering the initial injection, implying that if the blog sort creation endpoint is publicly accessible, the vulnerability can be exploited by unauthenticated remote attackers. The post-exploitation impact includes full compromise of the victim's interaction with the web application, as the attacker effectively operates under the privileges and session context of the compromised user."
}