CVE-2023-36825
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
The Orchid package, used for back-office application development, has a vulnerability related to the deserialization of untrusted data from the `_state` query parameter. This can lead to remote code execution. The issue has been addressed in version 14.5.0.
Risk Assessment
This vulnerability poses a serious security risk to applications, allowing attackers to execute code remotely, potentially leading to system takeover.
Recommendation
It is recommended to upgrade the software to version 14.5.0 or later, which includes the patch. There are no known workarounds.
Original NVD description (English source)
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.