-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| funadmin/funadmin | composer | <= 5.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability originates from the 'parentField' parameter in the Auth.php index method, which is passed through the application's code to the database layer. The selectList method in Curd.php handles this parameter and uses it to build a SQL query via the ORM's field method. Since neither the index method nor the selectList method properly sanitizes or parameterizes the input, the raw user input is injected into the SQL query. The GitHub issue explicitly identifies this flow, confirming the lack of filtering in the application's code before query execution.