Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-14146

CVE-2020-14146: KumbiaPHP Cross-site Scripting

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-14146
GHSA ID
GHSA-x6gq-vr59-4q5q
EPSS Score
0.43188%
CWE
CWE-79
Published
5/24/2022
Updated
4/23/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
kumbiaphp/kumbiappcomposer<= 1.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests in Development mode through PATH_INFO manipulation, indicating the framework reflects unescaped URL segments in error/debug output. The PagesController's __call method handles dynamic routing by method name (from PATH_INFO), and since there's no evidence of output encoding in error templates (shown in POC screenshots), this method becomes the injection point. The lack of patched versions and explicit sanitization in older releases supports this assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Kum*i*P*P t*rou** *.*.*, in **v*lopm*nt mo**, *llows XSS vi* t** `pu*li*/p***s/kum*i*/P*T*_IN*O`.

Reasoning

T** vuln*r**ility m*ni**sts in **v*lopm*nt mo** t*rou** P*T*_IN*O m*nipul*tion, in*i**tin* t** *r*m*work r**l**ts un*s**p** URL s**m*nts in *rror/***u* output. T** P***s*ontroll*r's __**ll m*t*o* **n*l*s *yn*mi* routin* *y m*t*o* n*m* (*rom P*T*_IN*O