Security Research

CVE-2024-29291 Laravel database credential leakage: the PDOException logging mistake

Thinking 2024-03-22 6 min read Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
Dark dossier of Laravel log file and leaked database credentials

When a PDO exception is thrown, Laravel writes the full database connection information, including the password, to the log. Anyone who gets the log can connect to the database with the leaked DSN, user, and password.

Unlock to view this content.