Threat Intelligence Database

LaraDashboard versions prior to 1.4.8 have an open redirect vulnerability in the EmailTemplateController's builder and builderEdit functions. This flaw allows remote attackers to craft URLs with an unvalidated redirect_url parameter that, when used by logged-in users with email template permissions, can redirect them to attacker-controlled phishing sites.

LaraDashboard versions before 1.4.8 have an incorrect authorization vulnerability that allows authenticated users with only the settings.view permission to access sensitive stored secrets. These secrets include plaintext AI provider API keys, mail credentials, passwords, and tokens accessible via the settings API endpoints. This vulnerability has a CVSS score of 6.5, indicating a high severity impact on confidentiality without affecting integrity or availability.

LaraDashboard versions before 1.4.8 perform advanced email validation on unauthenticated forgot-password and reset-password requests. This validation triggers DNS lookups and paid AbstractAPI verification calls. An unauthenticated attacker can abuse this by submitting arbitrary email addresses, exhausting the verification quota. Once exhausted, validation fails open for all public forms, potentially allowing invalid emails to pass unchecked. This behavior also allows attackers to probe domain resolution via DNS lookups.

LaraDashboard versions from 1.4.0 up to but not including 1.4.8 have a race condition vulnerability in the RegisterController::register function. This flaw allows unauthenticated attackers to bypass the per-IP daily registration limit by sending many concurrent registration requests, enabling bulk account creation and defeating anti-automation controls. The vulnerability has a CVSS score of 3.7, indicating medium severity.

LaraDashboard versions before 1.4.8 have an improper privilege management vulnerability that enables authenticated Admin users to escalate their privileges to Superadmin. This escalation is possible by editing or renaming roles, allowing attackers with the role.edit permission to rename their role to Superadmin or grant themselves user.login_as permissions. This access can lead to account takeover and the ability to perform core upgrade and module installation functions, potentially enabling code execution.

LaraDashboard versions prior to 1.4.8 have a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows systems, attackers can use URL-encoded backslash sequences to escape the intended directory and access sensitive JSON files such as composer.json. The vulnerability has a CVSS score of 3.7, indicating a medium severity level.

Lara Dashboard versions through 1.3.1 have a server-side request forgery (SSRF) vulnerability in the POST /api/admin/builder/markdown/fetch endpoint. This flaw allows any authenticated user to fetch arbitrary URLs and read the response body without host validation or redirect restrictions. Exploitation can lead to reading internal HTTP services and cloud metadata, including IAM credentials.

Lara Dashboard versions prior to 1.3.2 have an authorization flaw where the POST /admin/settings/core-upgrades/upload endpoint requires only the settings.edit permission. This allows non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Malicious archives can contain modified application files with embedded system commands that execute with the web server user's privileges, potentially exposing environment secrets and database credentials.

Lara Dashboard versions before 1.3.2 contain an authorization bypass vulnerability in the MarketplaceModuleBrowser installModule Livewire action. This flaw allows administrators without Superadmin privileges to install modules. Exploitation enables downloading and auto-activation of arbitrary PHP modules from the marketplace over unsigned HTTP requests, potentially leading to remote code execution.

Lara Dashboard versions before 1.3.2 contain an authorization flaw in the post-builder image and video upload endpoints. This flaw allows authenticated users without proper content permissions to upload files. Malicious actors can exploit this by uploading polyglot files with attacker-controlled extensions to the public web root, potentially leading to remote code execution if the deployment permits execution of such files.