Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided information, particularly the proof-of-concept and the patch, led to the identification of the vulnerable function. The PoC pointed to a SQL injection vulnerability in the moonshine-tree-resource component, triggered by a POST request to a /sortable endpoint. The commit 4fa8ce1925ed692ee89f06c1ce39a7e1d5f7af47 in the lee-to/moonshine-tree-resource repository, which corresponds to the patched version 2.0.2, contains the fix. The diff in routes/tree.php clearly shows the removal of the code that constructs and executes a raw SQL query using user-provided data. The vulnerable function is the closure that handles this request, as it directly processes the malicious input and constructs the vulnerable SQL query.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moonshine/moonshine | composer | <= 3.12.5 |
