Threat Intelligence Database

Lara Dashboard versions prior to 1.3.2 have an authorization flaw where the POST /admin/settings/core-upgrades/upload endpoint requires only the settings.edit permission. This allows non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Malicious archives can contain modified application files with embedded system commands that execute with the web server user's privileges, potentially exposing environment secrets and database credentials.

Lara Dashboard versions before 1.3.2 contain an authorization bypass vulnerability in the MarketplaceModuleBrowser installModule Livewire action. This flaw allows administrators without Superadmin privileges to install modules. Exploitation enables downloading and auto-activation of arbitrary PHP modules from the marketplace over unsigned HTTP requests, potentially leading to remote code execution.

Lara Dashboard versions before 1.3.2 contain an authorization flaw in the post-builder image and video upload endpoints. This flaw allows authenticated users without proper content permissions to upload files. Malicious actors can exploit this by uploading polyglot files with attacker-controlled extensions to the public web root, potentially leading to remote code execution if the deployment permits execution of such files.