GHSA-g4hp-pfvf-vm5w SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

• Packagist silverstripe/framework: >= 3.0.0, < 3.0.14 → fixed in 3.0.14 • Packagist silverstripe/framework: >= 3.1.0, < 3.1.13 → fixed in 3.1.13

When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters. For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service. The fix in this case is to ensure that empty tokens fail the validation check.