PT-2021-24378
Published
2021-04-29
·
Updated
2021-04-29
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
Laravel versions prior to 6.20.26
Laravel versions prior to 7.30.5
Laravel versions prior to 8.40.0
Description:
The issue affects users of SQL Server with Laravel who pass user input directly to the
limit and offset functions, making them vulnerable to SQL injection. This does not affect other database drivers like MySQL and Postgres.Recommendations:
For versions prior to 6.20.26, update to version 6.20.26 or later.
For versions prior to 7.30.5, update to version 7.30.5 or later.
For versions prior to 8.40.0, update to version 8.40.0 or later.
As a temporary workaround, ensure that only integers are passed to the
limit, offset, skip, and take functions. Found an issue in the description? Have something to add? Feel free to write us 👾