-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from direct execution of user-controlled PHP code through eval() in hook processing. The attack path described in GHSA-2x28-c7j7-23gv shows that attackers can write arbitrary code to files and trigger execution through the sitemap generation feature. The key vulnerable pattern is the unsafe use of eval() with untrusted $hook['code'] input, which meets CWE-94 criteria for code injection. While exact file paths aren't explicitly disclosed, the workflow described in the issue (#909) clearly indicates eval() usage with user-controlled hook configurations in backend administration components.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| intelliants/subrion | composer | <= 4.2.1 |
KEV Misses 88% of Exploited CVEs- Get the report