SQL injection in Laravel Framework - #VU156196
Published: April 28, 2021 / Updated: October 19, 2026
Vulnerability identifier: #VU156196
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject SQL commands, potentially accessing or modifying database data without authorization.
The vulnerability exists due to improper neutralization of SQL query input in SQL Server LIMIT / OFFSET handling when processing externally controlled pagination values. A remote attacker can supply crafted values that, if passed to the affected query handling, alter the SQL query structure to execute unauthorized SQL commands.
Affected software
Laravel Framework
Remediation
Install security update from vendor's website.
Laravel Framework - addressed in versions 6.20.26, 7.30.5, 8.40.0