GitHub Advisoryadvisory · Packagist

GHSA-w6jr-wj64-mc9x Deserialization of Untrusted Data in Codeigniter4

HIGH Published 2022-01-06 Modified 2022-01-06 Official page ↗
Aliases
CVE-2022-21647
Ecosystem
Packagist
Packages
codeigniter4/framework
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-01-06

Affected packages

• Packagist codeigniter4/framework: < 4.1.6 → fixed in 4.1.6

Description

Impact Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Patches Upgrade to v4.1.6 or later. Workarounds Do not use: • `old()` and form_helper • `RedirectResponse::withInput()` and `redirect()->withInput()` References • PHP Object Injection | OWASP For more information If you have any questions or comments about this advisory: • Open an issue in codeigniter4/CodeIgniter4 • Email us at SECURITY.md

Related

Alias · CVE (1)

  • CVE-2022-21647 CodeIgniter is an open source PHP full-stack web framework. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References