PT-2025-48416 · Moxi159753 · Mogu Blog

Sh7Err04 · Published 2025-12-01 · Updated 2025-12-03 · CVE-2025-13813

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moxi159753 Mogu Blog versions up to 5.2

Description A flaw exists in the Storage Management Endpoint component of moxi159753 Mogu Blog. The issue involves unauthorized processing of the /storage/ file, leading to a missing authorization check. This allows for remote exploitation, with a high complexity and difficult exploitability. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 5.2 should be updated.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2025-13813

Affected Products

Mogu Blog

References · 11

• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-broken_access_control-1/report.md#proof-of-concept · Exploit
• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-broken_access_control-1/report.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13813 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13813 · Vendor Advisory
• https://vuldb.com/?ctiid.333822 · Note
• https://vuldb.com/?submit.692104 · Note
• https://vuldb.com/?id.333822 · Note
• https://t.me/cveNotify/144374 · Telegram Post
• https://t.me/CVEtracker/38511 · Telegram Post
• https://t.me/cveNotify/144692 · Telegram Post
• https://twitter.com/CVEnew/status/1995392542741782539 · Twitter Post