-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| intelliants/subrion | composer | = 4.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing CSRF protection on a file deletion endpoint. The URL structure panel/uploads/read.json?cmd=rm indicates a controller handling file operations in the panel section. Since the advisory specifically mentions the application fails to validate CSRF tokens for GET requests, the function processing() this endpoint (likely named 'read' in an uploads controller) is vulnerable. The high confidence comes from the direct mapping between the exposed endpoint and typical MVC controller structure in CMS applications, combined with the explicit vulnerability description of missing CSRF checks on this specific GET request path.