I got sql injection attack for one of my routes in laravel

@tykus yeah it was bad search implementation. But what i want to know did he pass the routes and has access to the method or no

@demonz there was an attempt to execute the Eloquent query in the StudentController at line 44; how is it protected, can you share the route(s) that are mapped to the index action?

@tykus this is the route

Route::get('student', [StudentController::class, 'index'])->name('student.index')->middleware(['auth','role:SuperAdmin']);

and this is the method inside the controller

public function index()
   {
       return Inertia::render('Student/Index', [
                   'filters' => Request::all('search', 'trashed'),
                   'students' => new StudentCollection(
                       Student::orderBy('created_at','desc')
                           ->with('user')
                           ->filter(Request::only('search', 'trashed'))
                           ->paginate()
                           ->appends(Request::all())
                   ),
               ]);
    }

and this is the scope search

public function scopeFilter($query, array $filters)
   {
       $query->when($filters['search'] ?? null, function ($query, $search) {
           $query->where(function ($query) use ($search) {
          $query->whereRaw("CONCAT(first_name, ' ', second_name, ' ', last_name) LIKE '%{$search}%'"); // sql injection
               ->orWhereHas('user', function ($query) use ($search) {
                   $query->where('email', 'like', '%'.$search.'%');
               })
                     ->orWhere('mobile', 'like', '%'.$search.'%')
           });
       })->when($filters['trashed'] ?? null, function ($query, $trashed) {
           if ($trashed === 'with') {
               $query->withTrashed();
           } elseif ($trashed === 'only') {
               $query->onlyTrashed();
           }
       });
   }

the issue in here , how did he tried to use this method even that it's protected by middleware admin role ? does it mean he already has access to admin role for example using stolen token ? or this exception is normal when someone try to visit a route he doesn't has access to.

@demonz the middleware is intended to prevent access to the Route's action before it is executed, so auth and/or role middleware have been satisfied in this case, unless there is another unprotected route that delegates to StudentController@index?

Why do you think this action was malicious; do you know that it was not the SuperAdmin performing the action?

Aside, your whereRaw syntax does not parameterized the search, but you can modify it:

$search = "%{$search}%";
$query->whereRaw("CONCAT(first_name, ' ', second_name, ' ', last_name) LIKE ?", [
$search]);

@tykus it seems I was overthinking and it's not a sql injection attack haha. i guess the admin wrote a suspicious a paragraph in the search which made me think the hacker passed the route middleware LOL. anyway thank you bro.