-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| webbuilders-group/silverstripe-kapost-bridge | composer | < 0.4.0 | 0.4.0 |
Miggo AIRoot Cause AnalysisThe commit diff shows the vulnerable functions replaced Convert::raw2xml with Convert::raw2sql in KapostService.php. The original use of raw2xml (designed for XML escaping) instead of raw2sql (SQL-specific sanitization) left SQL queries unprotected. Both preview() and getPreview() directly process user-controlled parameters ($auth, $content_id) in database operations, making them entry points for SQL injection. The patch's targeted replacement confirms these functions were the vulnerability sources.