Lara Dashboard
Monthly
Host-header injection in LaraDashboard 2.3.0 and earlier allows remote attackers to poison the administrator password-reset link and redirect the reset token to an attacker-controlled host, enabling admin account takeover and, via the module installer, arbitrary PHP code execution. The reset URL is built with url(route(...)) rather than config('app.url'), so a crafted Host header controls the link; token capture still depends on administrator interaction or mail prefetching, and RCE requires module upload after takeover. No public exploit identified at time of analysis; vendor patch commit/advisory exist, and EPSS is 0.11% (29th percentile).
Host-header injection in LaraDashboard 2.3.0 and earlier allows remote attackers to poison the administrator password-reset link and redirect the reset token to an attacker-controlled host, enabling admin account takeover and, via the module installer, arbitrary PHP code execution. The reset URL is built with url(route(...)) rather than config('app.url'), so a crafted Host header controls the link; token capture still depends on administrator interaction or mail prefetching, and RCE requires module upload after takeover. No public exploit identified at time of analysis; vendor patch commit/advisory exist, and EPSS is 0.11% (29th percentile).