-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyrocms/pyrocms | composer | <= 3.7 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs because the uninstall endpoint (admin/addons/uninstall/{plugin}) uses a GET request for a state-changing operation. In Laravel/PyroCMS architecture, routes handling destructive actions should require POST requests with CSRF tokens. The controller method processing this GET request lacks CSRF protection middleware/token validation, making it susceptible to CSRF attacks. This matches the described attack vector where a simple GET request triggers plugin deletion without user consent verification.
Ongoing coverage of React2Shell