https://lukaszpastuszak.dev/tags/laravel/Recent content in Laravel on Łukasz Pastuszak - security notesHugoen-usWed, 30 Mar 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/altered/Wed, 30 Mar 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/altered/A Laravel password-reset PIN falls to brute force once an X-Forwarded-For rate-limit bypass is in place, PHP type juggling skips a secret check to expose a UNION SQL injection, INTO OUTFILE drops a webshell for www-data, and an unpatched kernel (Dirty Pipe, CVE-2022-0847) gives root.