-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 8.0, < 8.7.30 | 8.7.30 |
| typo3/cms | composer | >= 9.0, < 9.5.12 | 9.5.12 |
| typo3/cms | composer | >= 10.0, < 10.2.2 | 10.2.2 |
| typo3/cms-core | composer | >= 8.0, < 8.7.30 | 8.7.30 |
| typo3/cms-core | composer | >= 9.0, < 9.5.12 | 9.5.12 |
| typo3/cms-core | composer | >= 10.0, < 10.2.2 | 10.2.2 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the QueryGenerator class in the lowlevel extension as the source of improper SQL escaping. The generateQuery() method is the core query construction method in this class, and SQL injection vulnerabilities in query generators typically stem from unsafe concatenation of user input into SQL strings. The requirement for admin privileges aligns with the lowlevel extension's backend tools access. Though no patch diff is available, the CVE description's specificity about the affected component and vulnerability type provides high confidence in this assessment.
PHPPHP