GitHub Advisoryadvisory · Packagist

GHSA-27qr-636m-wxg2 codeigniter/framework SQL injection in ODBC database driver

CRITICAL Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: codeigniter/framework
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Reviewed: 2024-05-15

Affected packages

• Packagist codeigniter/framework: < 3.1.0 → fixed in 3.1.0

Description

CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This update includes crucial fixes to mitigate a SQL injection vulnerability, preventing potential exploitation by attackers. It is noteworthy that these fixes render the query builder and escape() functions incompatible with the ODBC driver. However, the update introduces actual query binding as a more secure alternative.

References

https://github.com/simplysites/CodeIgniter/commit/3d10ffa77854044570a1809a884776fd4bbd8b70 web
https://forum.codeigniter.com/thread-65803.html web
https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter/framework/2016-07-26-1.yaml web
https://github.com/simplysites/CodeIgniter package