PT-2021-24472 · Packagist · Illuminate/Database+1

Published 2021-02-02 · Updated 2021-02-02

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description.

Description: The issue arises when a field, normally a non-array value, is crafted as an array and not validated or cast to its expected type before being passed to the query builder. This can lead to an unexpected number of query bindings being added to the query, potentially causing it to return unexpected results. In some cases, the query may return no results.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

GHSA-X7P5-P2C9-PHVG

Affected Products

Illuminate/Database

Laravel Framework

References · 5

• https://osv.dev/vulnerability/GHSA-x7p5-p2c9-phvg · Vendor Advisory
• https://github.com/laravel/framework/security/advisories/GHSA-x7p5-p2c9-phvg · Note
• https://packagist.org/packages/illuminate/database · Note
• https://packagist.org/packages/laravel/framework · Note
• https://github.com/advisories/GHSA-3p32-j457-pg5x · Note