Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-37626

CVE-2021-37626: PHP file inclusion via insert tags

6.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-37626
GHSA ID
GHSA-r6mv-ppjc-4hgr
EPSS Score
0.77845%
CWE
CWE-94
Published
8/23/2021
Updated
4/22/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
contao/core-bundlecomposer>= 4.0.0, < 4.4.564.4.56
contao/core-bundlecomposer>= 4.5.0, < 4.9.184.9.18
contao/core-bundlecomposer>= 4.10.0, < 4.11.74.11.7
contao/contaocomposer>= 4.0.0, < 4.4.564.4.56
contao/contaocomposer>= 4.5.0, < 4.9.184.9.18
contao/contaocomposer>= 4.10.0, < 4.11.74.11.7

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers around improper handling of insert tags that could reference PHP files. Contao's architecture processes insert tags through dedicated controllers and parsers. The CWE-94 classification indicates code injection via controlled input, which would occur in the insert tag processing pipeline. While exact pre-patch code isn't available, Contao's security advisory and PHP file inclusion context strongly implicate the core insert tag handling components. The fixed versions (4.4.56 etc.) would have added validation/restrictions in these areas.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t It is possi*l* *or untrust** us*rs to lo** *r*itr*ry P*P *il*s vi* ins*rt t**s. Inst*ll*tions *r* only *****t** i* t**r* *r* untrust** ***k *n* us*rs. ### P*t***s Up**t* to *ont*o *.*.**, *.*.** or *.**.*. ### Work*roun*s *is**l* t**

Reasoning

T** vuln*r**ility **nt*rs *roun* improp*r **n*lin* o* ins*rt t**s t**t *oul* r***r*n** P*P *il*s. *ont*o's *r**it**tur* pro**ss*s ins*rt t**s t*rou** ***i**t** *ontroll*rs *n* p*rs*rs. T** *W*-** *l*ssi*i**tion in*i**t*s *o** inj**tion vi* *ontroll**