-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| opencart/opencart | composer | <= 3.0.3.9 |
Miggo AIRoot Cause AnalysisThe primary vulnerability stems from the saveLookup function in divido.php, which directly interpolates untrusted $order_id into SQL queries without proper sanitization. Though getLookupByOrderId uses (int) casting, the attack flow shows user input reaches saveLookup through the update controller, bypassing this protection. The Snyk PoC demonstrates exploitation via order_id manipulation, confirming the injection occurs in these database interaction functions.
A Semantic Attack on Google Gemini - Read the Latest Research