CVE-2023-44812

Deeper analysis

CVE-2023-44812 is a reflected cross-site scripting vulnerability affecting mooSocial version 3.1.8. The flaw resides in the user login function and is triggered when an attacker supplies a crafted payload through the admin_redirect_url parameter, allowing execution of arbitrary script in the context of a victim's browser.

A remote attacker can exploit the issue without authentication by luring an authenticated administrator or user into following a malicious link. Successful exploitation results in the ability to execute JavaScript in the victim's session, potentially leading to theft of session tokens, redirection to attacker-controlled sites, or other client-side actions permitted by the reflected XSS context.

The EPSS score for this CVE rose from a low baseline to a peak of 0.4970 before settling at the current value of 0.3665, indicating a clear increase in observed exploitation interest after public disclosure. Public references consist of proof-of-concept repositories that demonstrate the payload but contain no official vendor advisory or patch information.