-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bagisto/bagisto | composer | <= 2.3.7 | 2.3.8 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic case of CSV Formula Injection (CWE-1236), where the application fails to sanitize user-provided input before including it in a CSV export. The root cause is the lack of input validation and sanitization on product attributes, specifically those that use a rich text editor (TinyMCE).
The analysis of the patch commit 8076c708498a0187bc952d5f5f705e0cb1919682 reveals the vulnerable code path and the fix. The vulnerability is triggered when a user with privileges to edit products injects a string starting with a formula character (e.g., =) into a product field. The Webkul\Admin\Http\Controllers\Catalog\ProductController::update function was identified as the vulnerable function because, prior to the patch, it would take this raw, unsanitized input via request()->all() and save it to the database.
The patch addresses this by introducing several changes:
stevebauman/purify, is added for HTML sanitization.clean_content(), is created in packages/Webkul/Core/src/Http/helpers.php. This function uses the new library to clean the content and also removes potentially harmful template syntax.packages/Webkul/Admin/src/Http/Requests/ProductForm.php form request is modified to use a new passedValidation() method. This method is automatically called after validation passes and it sanitizes the input for any TinyMCE-enabled fields by applying the clean_content() function.ProductController::update method is changed to use the data from the ProductForm request object ($request->all()) instead of the global raw request (request()->all()). This ensures that the controller receives the sanitized data.Therefore, any runtime profile during the exploitation of this vulnerability on an unpatched system would show the Webkul\Admin\Http\Controllers\Catalog\ProductController::update method processing the malicious input. While the vulnerability manifests upon CSV export, the fix was applied at the point of data entry to prevent malicious data from being stored in the first place.
Webkul\Admin\Http\Controllers\Catalog\ProductController::updatepackages/Webkul/Admin/src/Http/Controllers/Catalog/ProductController.php
PHPPHPOngoing coverage of React2Shell