-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | >= 16.0.0, < 16.0.5 | 16.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the email parameter handling within ajax.php. The commit diff shows the filter was incorrectly passed as a string literal instead of the FILTER_VALIDATE_EMAIL constant, rendering the validation ineffective. Attackers could supply a wildcard email value (e.g., %) to match all records in the SQL query executed by the 'getContacts' action. The patch corrected this by using the proper filter constant, confirming this function's role in the vulnerability.