-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises in the SQL query construction in demo/index.php. User-controlled input (sort/id parameter) is directly interpolated into the SQL string via $request->get('sort', 'id') and used in the ORDER BY clause. The fetchAll method then executes this raw, unsanitized query. The patch fixes this by using quoteIdentifier on $sort and validating $direction, confirming the lack of input sanitization in the original code. While the root cause is the unsafe interpolation, fetchAll is the function that ultimately executes the vulnerable SQL, making it the critical point of exploitation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ttskch/pagination-service-provider | composer | < 1.0.0 | 1.0.0 |
PHPPHP