-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mautic/core | composer | >= 2.14.1, < 4.4.12 | 4.4.12 |
| mautic/core | composer | >= 5.0.0-alpha, < 5.0.4 | 5.0.4 |
Miggo AIRoot Cause AnalysisThe pre-patch code in ReportModel.php contained a direct call to $query->add('orderBy', $order) without validating the 'order' parameter. This parameter was derived from user-controllable inputs like URL parameters (orderby). The absence of column whitelisting or proper escaping allowed SQL injection. The patch introduced validation via getOrderBySanitized() and orderByIsValid(), confirming the vulnerability stemmed from improper handling of the orderBy clause in this function.
KEV Misses 88% of Exploited CVEs- Get the report