-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yiisoft/yii | composer | < 1.1.27 | 1.1.27 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe deserialization via unserialize() on user input. The commit diff shows critical changes to CDbCriteria::__wakeup(), a PHP magic method invoked during deserialization. The original code lacked a check for whether $this->params was an array, allowing attackers to inject malicious data. This method acts as a deserialization gadget, enabling RCE when combined with user-controlled unserialize() calls. The patch explicitly validates $this->params, confirming this was the exploitable entry point.