-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from improper SQL identifier quoting in the order key handling logic. The patch adds quoteIdentifier() calls to all order key components, proving the original code lacked necessary sanitization. The function prepareListingForGrid handles user-provided sorting parameters and directly interpolated them into SQL queries, making it the clear injection point. The high confidence comes from: 1) The CWE-89 classification, 2) The patch's focus on adding quoting in this function, and 3) The vulnerability's description tying exploitation to SQLi via sorting parameters.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | < 10.6.4 | 10.6.4 |
Ongoing coverage of React2Shell