An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24940
Reference (s):
- https://blog.laravel.com/security-release-laravel-61834-7232