-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the pre-patch implementation that used orderByRaw($orderByRaw) with raw user input. The $orderByRaw parameter was constructed from request parameters (sidx/sord) without proper validation. The patch replaced orderByRaw with parameterized orderBy() calls after splitting and validating components, confirming the original raw SQL usage was the injection vector. The function's direct handling of user input in SQL construction makes it clearly vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mgallegos/laravel-jqgrid | composer | <= 1.3.0 |
PHPPHPOngoing coverage of React2Shell