GHSA-w6jr-wj64-mc9xHighCVSS 7.7

Deserialization of Untrusted Data in Codeigniter4

Published
January 6, 2022
Last Modified
January 24, 2024

🔗 CVE IDs covered (1)

CVE-2022-21647 →

📋 Description

Impact

Deserialization of Untrusted Data was found in the old() function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection.

Patches

Upgrade to v4.1.6 or later.

Workarounds

Do not use:

  • old() and form_helper
  • RedirectResponse::withInput() and redirect()->withInput()

References

For more information

If you have any questions or comments about this advisory:

🎯 Affected products1

  • composer/codeigniter4/framework:< 4.1.6

🔗 References (5)