-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/IBAX-io/go-ibax | go | < 1.4.2 | 1.4.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized user input in the 'order' parameter being directly interpolated into SQL queries. The removed GetRowsInfo function in database.go uses fmt.Sprintf to build queries with user-controlled 'execOrder' (derived from 'order' parameter), enabling arbitrary SQL injection. The POC demonstrates injection via pg_sleep payload in the order parameter. The commit fixes this by removing the entire vulnerable endpoint handling code, confirming these functions were the attack surface.
Ongoing coverage of React2Shell