-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| froxlor/froxlor | composer | < 0.10.14 | 0.10.14 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped use of $this->_data['mysql_database'] and $this->_data['mysql_root_user'] in a shell command built in _backupExistingDatabase. The patch explicitly adds escapeshellarg() to these parameters, confirming the lack of input sanitization was the root cause. The exec() call executes this tainted command string, making the function the clear injection point. The commit diff and CVE description directly correlate to this function.
PHPPHP