-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| codiad/codiad | composer | >= 1.7.8, <= 2.8.4 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies components/market/controller.php as the location lacking CSRF protection. In typical MVC patterns, controller actions handling POST requests (like plugin downloads) would be responsible for CSRF validation. The absence of CSRF checks in the download handler allows forged requests to execute privileged marketplace operations. While the exact function name isn't explicitly stated in sources, the controller structure and vulnerability pattern strongly indicate the download action handler as the vulnerable function.