-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability exists in multiple models within the Easy!Appointments application. The root cause is the improper handling of the order_by parameter in various get() and search() methods. User-supplied input was directly passed to the order_by() clause of the database query, making it possible for an attacker to inject malicious SQL code. The patch addresses this by escaping the order_by parameter using $this->db->escape(), which neutralizes any special SQL characters and prevents the injection. The widespread nature of this flaw across numerous models indicates a pattern of insecure coding practice that was corrected in the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| alextselegidis/easyappointments | composer | < 1.5.2-beta.1 | 1.5.2-beta.1 |
Ongoing coverage of React2Shell