GHSA-44pg-c29v-hp6r: 
PHP vulnerability analysis and mitigation

A security vulnerability was identified in Laravel framework versions 5.5.0-5.5.49, 6.0.0-6.18.34, and 7.0.0-7.23.2, tracked as GHSA-44pg-c29v-hp6r. The vulnerability involves a guard bypass in Eloquent models where mass assignment operations could include model table names, potentially leading to security issues. The issue was discovered and patched with the release of Laravel versions 6.18.34 and 7.23.2 on August 6, 2020 (Laravel Blog).

The vulnerability stems from an undocumented 'convenience' feature in Eloquent that automatically stripped table names from attributes during mass assignment operations. For example, when using $model->fill(['users.name' => 'Taylor']), Eloquent would remove the table name from the attribute. This behavior, when combined with validation mechanisms, could result in unexpected and unvalidated values being stored in the database. The vulnerability is classified as moderate severity and is associated with CWE-20 (GitHub Advisory).

The vulnerability could lead to unexpected and unvalidated values being saved to the database, potentially bypassing intended security controls. This could affect applications that unknowingly relied on the undocumented table name stripping feature during mass assignment operations (Laravel Blog).

The vulnerability could be exploited through mass assignment operations that include table names in the attribute fields. The exploitation requires the application to use the affected versions of Laravel and implement mass assignment operations in a specific way (GitHub Advisory).

The issue has been resolved in Laravel versions 6.18.34 and 7.23.2. The fix removes the automatic stripping of table names from mass-assignment operations, ensuring attributes go through the typical 'fillable'/'guarded' logic. Any attributes containing table names that are not explicitly declared as fillable will be discarded. Users are advised to upgrade to the patched versions (Laravel Blog).