-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability exists because of insufficient file validation during the upload process. The application only checks the mime type of the file, which is not a reliable way to determine the file type. An attacker can easily manipulate the mime type by adding a few bytes to the beginning of the file. The application should also validate the file extension and not allow executable files (like .php) to be uploaded. The upload function in BadasoFileController is the entry point for the file upload functionality and is where the validation should be performed. The lack of proper validation in this function is the root cause of the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| badaso/core | composer | <= 2.9.11 |
Ongoing coverage of React2Shell