GHSA-rj3w-99gc-8j58: 
PHP vulnerability analysis and mitigation

Laravel framework versions 4.0.0 to 4.1.29 contain a mass-assignment vulnerability when not using the fillable property on models. The vulnerability was discovered and disclosed on May 20, 2014, affecting Laravel framework installations that use guarded instead of fillable for mass assignment protection (GitHub Advisory).

The vulnerability exists in the column quoting implementation for database drivers. When using the guarded property instead of fillable and passing user-controlled arrays into update or save methods, applications may be vulnerable to mass assignment attacks. The issue was fixed in Laravel 4.1.29 by improving the column quoting for all database drivers (GitHub Advisory).

Applications that use guarded property and pass user-controlled arrays into update or save methods could be vulnerable to mass assignment attacks, potentially allowing attackers to modify unauthorized model attributes (GitHub Advisory).

The vulnerability is exploitable when applications use the guarded property for mass assignment protection and pass user-controlled input arrays directly into update or save methods. Applications using the fillable property for mass assignment protection are not vulnerable (GitHub Advisory).

Users should upgrade to Laravel 4.1.29 or later immediately if they are using guarded and passing user-controlled arrays into update or save methods. Alternatively, using the fillable property instead of guarded on models provides protection against this vulnerability (GitHub Advisory).