-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gugoan/economizzer | composer | <= 0.9-beta1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient file type validation during cash book entry creation. While frontend validation exists, the backend (controller and model) fails to properly validate file types server-side. The attack flow involves: 1) Controller action receiving upload via POST /cashbook/create, 2) Model handling file persistence without proper extension/MIME checks. The combination allows PHP file uploads that are subsequently executable via direct web access. The high confidence comes from the documented attack pattern (PHP web shell upload) and CWE-434 classification, which typically involves missing server-side validation in file handling functions.
Ongoing coverage of React2Shell