laravel framework SQL Injection via limit and offset functions
As published by the sources
Affected packages
- Affected
>=6.0.0,<6.20.26 || >=7.0.0,<7.30.5 || >=8.0.0,<8.40.0Fixed in6.20.267.30.58.40.0
Derived from the fixed versions above
What to do
Upgrade laravel/framework to the fixed version in your release line: 6.20.26, 7.30.5, 8.40.0.
composer update laravel/framework --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
Impact
Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.
Patches
This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.
Workarounds
You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.