-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | < 10.5.21 | 10.5.21 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe handling of the 'property' parameter in the getGridFilterCondition method. The original code (before patch) concatenated user-controlled $field into an SQL condition without using quoteIdentifier(), allowing SQL injection. The patch explicitly fixes this by adding quoteIdentifier() around $field, confirming this was the vulnerable code path. The function's role in processing API filters and the direct use of user input in SQL construction make it the clear entry point for the injection.