The flaw in mooSocial versions up to 3.2.4 allows the injection of arbitrary SQL through manipulation of the 'rating' argument in the /stores/all-products endpoint. An attacker can send a crafted HTTP request that exploits the lack of input validation. This vulnerability can be triggered remotely and, according to the CVE advisory, a publicly available exploit package has been released, indicating that it may be used for real‑world attacks.

The vulnerability affects all releases of mooSocial 3.2.4 and earlier. Any installation hosting the /stores/all-products endpoint, regardless of network boundary, is susceptible once exposed to external requests. The vendor did not provide a fix at the time of disclosure, so no specific upgrade path is available.

The CVSS score of 6.9 signals moderate risk, yet the publicly available exploit package and remote launch capability raise the potential for real‑world attacks. The lack of EPSS data does not diminish the observed threat, and the flaw is listed in no KEV catalog. Attackers would require network reachability to the vulnerable endpoint, and no authentication is needed to trigger the injection. Because the flaw can be triggered on any exposed instance, the overall likelihood of exploitation remains significant.