-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| remdex/livehelperchat | composer | < 4.29 | 4.29 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped 'search' parameter being passed to the template engine via $tpl->set('keyword', $keywordSearch) in faqwidget.php. The patch adds str_replace to remove {{ and }}, confirming these delimiters were the injection vector. The function is part of the template rendering flow, and improper input sanitization here allows attackers to inject server-side template code. The high confidence comes from the direct correlation between the patch location and the vulnerability description.