The Code Log
Welcome to my blog, a space where I share insights, lessons, and best practices from building secure, scalable web applications and SaaS solutions. From tackling complex development challenges to exploring modern tools, frameworks, and security techniques, this is where I document what works, what doesn’t.
Livewire File Upload Bypass: Smuggling a PHP Shell Past MIME Validation
The file upload validator checks the extension and rejects .php. The MIME validator asks the browser what type the file is. The browser says image/jpeg. The server trusts it. The file, a PHP webshell with a .php extension inside a polyglot wrapper, lands in a publicly accessible directory.
IDOR in Laravel: Exploiting Missing Authorization on Route Model Binding
Route model binding resolves the right database row but never asks whether the authenticated user owns it. An attacker authenticated as any user, even one gained via mass assignment or type juggling from earlier posts, can enumerate IDs and read, modify, or delete other users' posts, profile data, and private content. Covers the exact Eloquent query pattern that creates the vulnerability, how authorization gates and policies prevent it, and the detection grep that finds every vulnerable route in a codebase.
The ORM Didn't Save You: SQL Injection Through Raw Query Builder Methods in Laravel 12
Eloquent's query builder is safe, but Laravel's raw SQL escape hatches, DB::select(), DB::raw(), whereRaw(), orderByRaw(), havingRaw(), and DB::statement(), bypass parameter binding entirely. A single unauthenticated endpoint with concatenated input lets an attacker exfiltrate every table in the database using SQLMap in under two minutes.
PHP Type Juggling: Bypassing Laravel Authentication with == vs ===
PHP's == operator sees '0e830400451993494058024219903391' and '0e462097431906509019562988736854' as equal, both look like scientific notation and coerce to the float 0.0. If a stored MD5 password hash happens to start with '0e' followed only by digits, a publicly known six-character string like 'QNKCDZO' logs in as that user, no brute force required.