MoonShine SQL Injection Vulnerability in Blog Module

A SQL injection vulnerability has been identified in MoonShine version 3.12.5, specifically within the Blog module. The issue arises in the Data parameter when using the moonshine-tree-resource component, which is vulnerable in versions prior to 2.0.2. This vulnerability allows for the injection of SQL payloads, potentially leading to unauthorized data access or manipulation.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations depending on the application's database permissions.

Reproduction

To reproduce this vulnerability, upload a category in the Blog module while the moonshine-tree-resource component is active. Intercept the request and inject a SQL payload into the Data parameter. Once the payload is executed, the database version can be extracted and verified.