-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability occurs in Addon.php's plugin installation handler. The reproduction steps demonstrate that: 1) Attackers can upload arbitrary ZIP packages through /backend/ajax/uploads 2) The localinstall endpoint processes these packages without sanitizing controller files 3) Malicious code in addons[plugin]\controller\Index.php gets executed when accessed. The root cause is the lack of code validation in the plugin installation workflow, specifically in the localinstall method, which allows arbitrary PHP code execution through uploaded plugin controllers.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| funadmin/funadmin | composer | <= 3.2.0 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report