CVE-2023-36825

CRITICAL

Orchid Platform 14.0.0-alpha4-14.5.0 - Remote Code Execution via _state Query Parameter Deserialization

Title source: llm

Description

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3p

Release Notes x_refsource_misc

https://github.com/orchidsoftware/platform/releases/tag/14.5.0

Scores

CVSS v3 9.6

EPSS 0.0095

EPSS Percentile 56.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-502

Status published

Products (3)

orchid/platform 14.0.0 (5 CPE variants)

orchid/platform 14.0.0-alpha4 - 14.5.0Packagist

orchid/platform 14.0.1 - 14.5.0

Published Jul 11, 2023

Tracked Since Feb 18, 2026