| Description: | | The Laravel Ignition component shipped with Laravel 8.0 contains a pre-authentication remote-code-execution flaw. Attackers can send a crafted request to the framework’s built-in error-solution endpoint and inject a serialized payload that instructs the templating engine to load an arbitrary file path. By chaining this primitive with PHP’s base64 filter wrapper, the adversary is able to turn a file-read primitive into full code execution on the underlying server. Successful exploitation grants the attacker the same privileges as the web-server user, allowing complete takeover of the application host, lateral movement inside the infrastructure, installation of persistent backdoors, and exfiltration of sensitive application secrets such as database credentials, cloud access keys, and user session stores. |