Description

Laravel debug mode exposes sensitive data, eg: internal source codes, stack traces, sql queries, databases names, tables names, user’s cookies, email, phone number, username, laravel version, php version, etc

Proof of Concept

1. Login into http://demo.microweber.org
2. Navigate to this endpoint(including single quote at the end): http://demo.microweber.org/demo/admin/category/create’
3. you will see all the exposed information.

Impact

Server running in debug mode, exposing sensitive information about server and user.