-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| francoisjacquet/rosariosis | composer | < 11.0 | 11.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from predictable filenames in the salaries module. The _saveSalariesFile function in modules/Accounting/functions.inc.php was directly responsible for generating these filenames. The commit diff shows this function used a timestamp-based filename format (date('Y-m-d_His')) before the patch, which only provided second-level precision. This made brute-force enumeration feasible. The CVE specifically references the salaries module, and the patched version modifies this exact function to add microsecond entropy. Other modified functions (e.g., in Student_Billing) are less directly tied to the explicitly mentioned 'salaries' module vulnerability.