-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | >= 6.0.0, < 6.20.26 | 6.20.26 |
| laravel/framework | composer | >= 7.0.0, < 7.30.5 | 7.30.5 |
| laravel/framework | composer | >= 8.0.0, < 8.40.0 | 8.40.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from SQL Server's handling of limit/offset parameters in Laravel's query builder. The SQL Server grammar (SqlServerGrammar) directly interpolates these values into the SQL string without parameterization. The Builder's limit() and offset() methods act as entry points for untrusted input. Patches enforced integer casting in these methods and switched to parameter binding in the grammar, confirming these functions' roles in the vulnerability.
Ongoing coverage of React2Shell