-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| frozennode/administrator | composer | <= 5.0.12 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs at the admin/tips_image/image/file_upload endpoint which handles file uploads. While exact source code isn't available, the exploit requires: 1. Lack of proper file content validation (accepts PHP code in files with GIF headers) 2. Failure to properly validate/sanitize file extensions (.php allowed) 3. Storing uploaded files in web-accessible locations. The controller method handling this endpoint is directly responsible for these missing security checks, making it the primary vulnerable function. The high confidence comes from the well-documented exploit pattern matching CWE-434 and the specific attack vector described (PHP-in-GIF with .php extension).
Ongoing coverage of React2Shell