-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a blind SQL injection in Magento's Search module (CWE-89). Analysis of historical Magento SQLi patterns and Adobe's advisory indicates the MySQL query builder's MATCH clause construction was vulnerable. The Match::build method handles search query parameters and was found to directly incorporate user input into SQL commands without adequate sanitization. This aligns with the described attack vector requiring search functionality interaction, consistent with the module and vulnerability type specified.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | < 2.3.6-p1 | 2.3.6-p1 |
| magento/community-edition | composer | >= 2.4.0, < 2.4.1-p1 | 2.4.1-p1 |