-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | >= 5.5.0, <= 5.5.49 | |
| laravel/framework | composer | >= 6.0.0, < 6.18.34 | 6.18.34 |
| laravel/framework | composer | >= 7.0.0, < 7.23.2 | 7.23.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Laravel's Eloquent Model processed mass assignment attributes. The fill() method (or its internal helpers) automatically removed table prefixes from attribute keys (e.g., 'users.name' → 'name') before checking against $fillable/$guarded. This preprocessing occurred before validation, allowing attackers to submit attributes with table prefixes that would be transformed into valid fillable fields after stripping. The security fix removed this automatic stripping, meaning the full attribute name (including table prefix) must now be explicitly declared as fillable. The fill() method is explicitly mentioned in the vulnerability example and is the primary entry point for mass assignment operations, making it the clear vulnerable function.
Ongoing coverage of React2Shell