-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized GET parameter handling in carte.php. The commit diff shows the fix added filtering parameters ('alphanohtml' and 'aZ09') to GETPOST calls. The primary vulnerable function is GETPOST() without filtering, as explicitly mentioned in CVE description. Other parameters (foruserid, mode, model, modellabel) showed similar vulnerable patterns but weren't explicitly exploited. The core issue was missing input validation when retrieving parameters via GETPOST.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | < 7.0.2 | 7.0.2 |