Questions tagged [laravel]

Laravel is a PHP framework.

Filter by
Sorted by
Tagged with
0 votes
1 answer
38 views

Hidden Input prevent value changing - Laravel

So I was testing my application for some vulerabilities and found one that I missed: <input class="hidden" type="hidden" name="event_id" value="{{$event->id)}}&...
user avatar
1 vote
2 answers
267 views

SQL Injection detected

I was loading my sites front end and watching the responses in burpsuite when I noticed a response which contained a very verbose sql error "message": "SQLSTATE[22P02]: Invalid text ...
user avatar
  • 95
0 votes
1 answer
220 views

How to secure Laravel website against the ongoing massive exploitation

My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
user avatar
0 votes
1 answer
118 views

What should I worry about when attaching a token to a request manually?

I'm developing a platform that has 2 parts: An API written using Laravel, that integrates with the database and provided data in a restful state. Multiple fronts that connect to the API and perform ...
user avatar
  • 111
0 votes
0 answers
84 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
user avatar
  • 101
2 votes
2 answers
168 views

Is there any way an attacker can access the server and modify the site (php) code? [closed]

I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified. The files modified were mostly storage - logs/...
user avatar
  • 21
0 votes
2 answers
385 views

How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?

I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
user avatar
  • 3
0 votes
2 answers
196 views

Security breach from contact form in Laravel 5.8.36?

the most bizarre thing happened, someone fount out the smtp mail driver credentials from a Laravel project, which are stored in the .env. The credentials are used for a contact form. The .env was in ...
user avatar
  • 1
0 votes
1 answer
111 views

Laravel | Why create a public_html folder and link/move it?

I am using laravel on shared hosting. Under my domain in my folder is the laravel app. Now I see online that many people do weird stuff with the laravel public folder, they either move it to a ...
user avatar
  • 157
1 vote
0 answers
541 views

Identifying Source of Malware Attack on Laravel App

We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin Recently that server issued a maldet warning (our ...
user avatar
2 votes
1 answer
3k views

Missing HTTPOnly Cookie Attribute in Laravel 7 [duplicate]

I have a Laravel site, I thought I patched this issue already. I got these in my session.php 'secure' => true, 'http_only' => true, But OpenVas still detected that I still need to it. It ...
user avatar
  • 125
0 votes
1 answer
152 views

If I seperate VPS into WebApp/MySQL VPS & separating WebApp projects into Admin/User projects. Is It more secure?

If I want to deploy Laravel WebApp using MySQL DB on VPS like DigitalOcean, Vultr or similar platforms, should I separate VPS into WebApp VPS & MySQL VPS? Is it more secure? And what if I ...
user avatar
1 vote
1 answer
506 views

Session sync between two web apps on the same domain

I have a Laravel 6 site, and a legacy Drupal 7 site. Both are served under the same domain, and both share the same user database table. I'd like users to be able to log in via Laravel (never via ...
user avatar
  • 113
0 votes
1 answer
106 views

Use another ssl certificate even if server has other certificates

I deployed a laravel project to a server (in which I have root access). Then I was asked to install a ssl certificate to that project. But there are some projects that already have installed a ssl ...
user avatar
  • 1
1 vote
0 answers
722 views

laravel-poc-CVE-2018-15133 [closed]

I want to test laravel exploit POC based on https://github.com/kozmic/laravel-poc-CVE-2018-15133/ I did docker steps to reach laravel home page on localhost:8000 then I got API key and simply I put ...
user avatar
  • 11
2 votes
2 answers
5k views

How to detect website active routes?

I'm building a website using Laravel and I'm just thinking about security. I would like to know if there is a way for attacker to detect all active web routes for a website ? For example: http://...
user avatar
2 votes
1 answer
90 views

Limit rights for user applications

I have a website, where users are available to upload small applications which runs 24/7 on my server. So if the user upload an application, some folders will be created: /{USER_ID}/{APP_ID}/ (if ...
user avatar
-2 votes
2 answers
3k views

How to leave a backdoor in a Laravel application?

I'm pretty curious how someone could leave a backdoor in a Laravel application? In my opinion there isn't a way, because the entry point of the requests is a route file, and you have to write code for ...
user avatar
  • 97
6 votes
2 answers
2k views

Why does this Laravel CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
user avatar
  • 63