CVE-2023-43323
MEDIUM NUCLEImooSocial 3.1.8 - Server-Side Request Forgery via Post Function Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-43323. PoCs published by ahrixia. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository provides a functional proof-of-concept for CVE-2023-43323, demonstrating an SSRF vulnerability in mooSocial v3.1.8. The exploit leverages the 'data[userShareVideo]' parameter to trigger external HTTP/DNS requests to an attacker-controlled server.
Description
mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].
Exploits (1)
The repository provides a functional proof-of-concept for CVE-2023-43323, demonstrating an SSRF vulnerability in mooSocial v3.1.8. The exploit leverages the 'data[userShareVideo]' parameter to trigger external HTTP/DNS requests to an attacker-controlled server.
Nuclei Templates (1)
http.favicon.hash:702863115clear
mooSocial || moosocial || icon_hash="702863115"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N