-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from MysqlAdapter::applyLimit() not casting limit/offset parameters to integers before SQL construction. The commit diff explicitly shows the fix adding (int) casts to these parameters, and the vulnerability description demonstrates exploitation through limit() method injection. The tests added in the patch verify that non-integer values (including SQL injection payloads) get coerced to integers, confirming this was the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| propel/propel | composer | >= 2.0.0-alpha1, <= 2.0.0-alpha7 | 2.0.0-alpha8 |
Ongoing coverage of React2Shell