SQL Injection in mooSocial Product Rating Parameter

A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

mooSocial versions up to 3.2.4 contain a critical SQL injection vulnerability in the /stores/all-products endpoint, where the rating parameter fails to properly sanitize user input before processing database queries. This flaw (CWE-74: Improper Neutralization of Special Elements in Output, CWE-89: SQL Injection) allows unauthenticated attackers to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or destruction. Any organization deploying mooSocial for e-commerce or community marketplace functionality is at immediate risk, particularly since the exploit is publicly available and the vendor has not provided patches or security guidance. The lack of vendor response leaves affected instances vulnerable to both opportunistic and targeted attacks.

Casky's 754 security skills mapped to MITRE ATT&CK enable detection of this attack through reconnaissance (TA0001) and discovery (TA0043) techniques. Practitioners using Casky's Claude-powered analysis would identify suspicious patterns such as SQL metacharacters (single quotes, UNION statements, comment sequences) in rating parameter values, anomalous database query behavior, and unusual data exfiltration attempts. The platform's extended reasoning capabilities map these indicators to the broader attack chain—recognizing that initial reconnaissance through parameter fuzzing precedes exploitation, and that successful injection attempts correlate with attempts to enumerate database schemas or extract sensitive information. Security teams would see findings flagging malicious rating inputs, database connection anomalies, and data access patterns inconsistent with legitimate product filtering operations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105149.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-105149

Casky has 323 skills that investigate the attack patterns behind CVE-2026-105149. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn