-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | < 10.5.21 | 10.5.21 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the findAction method handling the 'fields[]' parameter. The pre-patch code lacked: 1) Removal of SQL comments (--), and 2) Proper exception handling for SQL syntax errors. The $fields parameter was incorporated into SQL queries without parameterization or proper escaping. The patch adds input sanitization (removing --) and exception handling, confirming the original code's vulnerability. The $searcherList->load() method execution context demonstrates direct SQL query execution with user-controlled input.