SB2021042859 - SQL injection in Laravel Framework

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021042859

SB2021042859 - SQL injection in Laravel Framework

Published: April 28, 2021 Updated: October 19, 2026

Security Bulletin ID SB2021042859
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject SQL commands, potentially accessing or modifying database data without authorization.

The vulnerability exists due to improper neutralization of SQL query input in SQL Server LIMIT / OFFSET handling when processing externally controlled pagination values. A remote attacker can supply crafted values that, if passed to the affected query handling, alter the SQL query structure to execute unauthorized SQL commands.


Remediation

Install update from vendor's website.

References