-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | < 10.5.19 | 10.5.19 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper SQL parameter handling in UUID DAO methods. The pre-patch code for getByUuid directly interpolated user input into SQL via string concatenation ('uuid=' . $uuid), creating classic SQL injection vulnerability. While exists() used a parameter placeholder, the patch added explicit type specification (Types::STRING), suggesting potential type safety issues. The commit diff shows both methods were modified to use proper parameter binding with query builder and type declarations, confirming these were the vulnerable entry points.