{"id":"GHSA-3p32-j457-pg5x","summary":"Query Binding Exploitation","details":"### Description\n\nLaravel versions \u003c6.20.12, \u003c7.30.3 & \u003c8.22.1 contain a query binding exploitation.\n\nIf a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.\n\nThis vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com).\n\n### References\n\n- https://github.com/laravel/framework/pull/35865","aliases":["BIT-laravel-2021-21263","CVE-2021-21263"],"modified":"2026-05-07T05:00:35.541854506Z","published":"2021-01-19T19:36:51Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-01-19T19:36:31Z","nvd_published_at":"2021-01-19T20:15:00Z","cwe_ids":["CWE-74","CWE-89"]},"references":[{"type":"WEB","url":"https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21263"},{"type":"WEB","url":"https://github.com/laravel/framework/pull/35865"},{"type":"WEB","url":"https://blog.laravel.com/security-laravel-62011-7302-8221-released"},{"type":"WEB","url":"https://blog.laravel.com/security-laravel-62012-7303-released"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yaml"},{"type":"WEB","url":"https://packagist.org/packages/illuminate/database"},{"type":"WEB","url":"https://packagist.org/packages/laravel/framework"}],"affected":[{"package":{"name":"laravel/framework","ecosystem":"Packagist","purl":"pkg:composer/laravel/framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.22.1"}]}],"versions":["v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.1.0","v8.10.0","v8.11.0","v8.11.1","v8.11.2","v8.12.0","v8.12.1","v8.12.2","v8.12.3","v8.13.0","v8.14.0","v8.15.0","v8.16.0","v8.16.1","v8.17.0","v8.17.1","v8.17.2","v8.18.0","v8.18.1","v8.19.0","v8.2.0","v8.20.0","v8.20.1","v8.21.0","v8.22.0","v8.3.0","v8.4.0","v8.5.0","v8.6.0","v8.7.0","v8.7.1","v8.8.0","v8.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-3p32-j457-pg5x/GHSA-3p32-j457-pg5x.json"}},{"package":{"name":"illuminate/database","ecosystem":"Packagist","purl":"pkg:composer/illuminate/database"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.30.3"}]}],"versions":["v7.0.0","v7.0.1","v7.0.2","v7.0.3","v7.0.4","v7.0.5","v7.0.6","v7.0.7","v7.0.8","v7.1.0","v7.1.1","v7.1.2","v7.1.3","v7.10.0","v7.10.1","v7.10.2","v7.10.3","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.14.1","v7.15.0","v7.16.0","v7.16.1","v7.17.0","v7.17.1","v7.17.2","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.20.0","v7.21.0","v7.22.0","v7.22.1","v7.22.2","v7.22.3","v7.22.4","v7.23.0","v7.23.1","v7.23.2","v7.24.0","v7.25.0","v7.26.0","v7.26.1","v7.27.0","v7.28.0","v7.28.1","v7.28.2","v7.28.3","v7.28.4","v7.29.0","v7.29.1","v7.29.2","v7.29.3","v7.3.0","v7.30.0","v7.30.1","v7.30.2","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.6.1","v7.6.2","v7.7.0","v7.7.1","v7.8.0","v7.8.1","v7.9.0","v7.9.1","v7.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-3p32-j457-pg5x/GHSA-3p32-j457-pg5x.json"}},{"package":{"name":"illuminate/database","ecosystem":"Packagist","purl":"pkg:composer/illuminate/database"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.22.1"}]}],"versions":["v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.1.0","v8.10.0","v8.11.0","v8.11.1","v8.11.2","v8.12.0","v8.12.1","v8.12.2","v8.12.3","v8.13.0","v8.14.0","v8.15.0","v8.16.0","v8.16.1","v8.17.0","v8.17.2","v8.18.0","v8.18.1","v8.19.0","v8.2.0","v8.20.0","v8.20.1","v8.21.0","v8.22.0","v8.3.0","v8.4.0","v8.5.0","v8.6.0","v8.7.0","v8.7.1","v8.8.0","v8.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-3p32-j457-pg5x/GHSA-3p32-j457-pg5x.json"}},{"package":{"name":"illuminate/database","ecosystem":"Packagist","purl":"pkg:composer/illuminate/database"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.20.12"}]}],"versions":["v6.0.0","v6.0.1","v6.0.2","v6.0.3","v6.0.4","v6.1.0","v6.10.0","v6.11.0","v6.12.0","v6.13.0","v6.13.1","v6.14.0","v6.15.0","v6.15.1","v6.16.0","v6.17.0","v6.17.1","v6.18.0","v6.18.1","v6.18.10","v6.18.11","v6.18.12","v6.18.13","v6.18.14","v6.18.15","v6.18.16","v6.18.17","v6.18.18","v6.18.19","v6.18.2","v6.18.20","v6.18.21","v6.18.22","v6.18.23","v6.18.24","v6.18.25","v6.18.26","v6.18.27","v6.18.28","v6.18.29","v6.18.3","v6.18.30","v6.18.31","v6.18.32","v6.18.33","v6.18.34","v6.18.35","v6.18.36","v6.18.37","v6.18.38","v6.18.39","v6.18.4","v6.18.40","v6.18.41","v6.18.42","v6.18.43","v6.18.5","v6.18.6","v6.18.7","v6.18.8","v6.18.9","v6.19.0","v6.19.1","v6.2.0","v6.20.0","v6.20.1","v6.20.10","v6.20.11","v6.20.2","v6.20.3","v6.20.4","v6.20.5","v6.20.6","v6.20.7","v6.20.8","v6.20.9","v6.3.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.6.0","v6.6.1","v6.6.2","v6.7.0","v6.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-3p32-j457-pg5x/GHSA-3p32-j457-pg5x.json"}},{"package":{"name":"laravel/framework","ecosystem":"Packagist","purl":"pkg:composer/laravel/framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.20.11"}]}],"versions":["v6.0.0","v6.0.1","v6.0.2","v6.0.3","v6.0.4","v6.1.0","v6.10.0","v6.10.1","v6.11.0","v6.12.0","v6.13.0","v6.13.1","v6.14.0","v6.15.0","v6.15.1","v6.16.0","v6.17.0","v6.17.1","v6.18.0","v6.18.1","v6.18.10","v6.18.11","v6.18.12","v6.18.13","v6.18.14","v6.18.15","v6.18.16","v6.18.17","v6.18.18","v6.18.19","v6.18.2","v6.18.20","v6.18.21","v6.18.22","v6.18.23","v6.18.24","v6.18.25","v6.18.26","v6.18.27","v6.18.28","v6.18.29","v6.18.3","v6.18.30","v6.18.31","v6.18.32","v6.18.33","v6.18.34","v6.18.35","v6.18.36","v6.18.37","v6.18.38","v6.18.39","v6.18.4","v6.18.40","v6.18.41","v6.18.42","v6.18.43","v6.18.5","v6.18.6","v6.18.7","v6.18.8","v6.18.9","v6.19.0","v6.19.1","v6.2.0","v6.20.0","v6.20.1","v6.20.10","v6.20.2","v6.20.3","v6.20.4","v6.20.5","v6.20.6","v6.20.7","v6.20.8","v6.20.9","v6.3.0","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.6.0","v6.6.1","v6.6.2","v6.7.0","v6.8.0","v6.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-3p32-j457-pg5x/GHSA-3p32-j457-pg5x.json"}},{"package":{"name":"laravel/framework","ecosystem":"Packagist","purl":"pkg:composer/laravel/framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.30.2"}]}],"versions":["v7.0.0","v7.0.1","v7.0.2","v7.0.3","v7.0.4","v7.0.5","v7.0.6","v7.0.7","v7.0.8","v7.1.0","v7.1.1","v7.1.2","v7.1.3","v7.10.0","v7.10.1","v7.10.2","v7.10.3","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.14.1","v7.15.0","v7.16.0","v7.16.1","v7.17.0","v7.17.1","v7.17.2","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.20.0","v7.21.0","v7.22.0","v7.22.1","v7.22.2","v7.22.3","v7.22.4","v7.23.0","v7.23.1","v7.23.2","v7.24.0","v7.25.0","v7.26.0","v7.26.1","v7.27.0","v7.28.0","v7.28.1","v7.28.2","v7.28.3","v7.28.4","v7.29.0","v7.29.1","v7.29.2","v7.29.3","v7.3.0","v7.30.0","v7.30.1","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.6.1","v7.6.2","v7.7.0","v7.7.1","v7.8.0","v7.8.1","v7.9.0","v7.9.1","v7.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-3p32-j457-pg5x/GHSA-3p32-j457-pg5x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}