CyberRota Analysis
AI-GeneratedLara Dashboard versions prior to 1.3.2 are vulnerable due to improper authorization on the POST /admin/settings/core-upgrades/upload endpoint, allowing non-Superadmin users to upload and extract arbitrary zip files. This vulnerability can lead to the execution of malicious code within the application, potentially compromising sensitive environment secrets and database credentials. Organizations using Lara Dashboard should prioritize patching this vulnerability to mitigate the risk of unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.