PT-2023-23966 · Unknown · Codeigniter

Kenjis · Publicado 2023-05-22 · Atualizado 2024-03-06 · CVE-2023-32692

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.3.5

Description This issue allows attackers to execute arbitrary code when using Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also affected because they use the Validation library internally.

Recommendations For versions prior to 4.3.5, upgrade to version 4.3.5 or later. As a temporary workaround, consider setting validation rules with an array to minimize the risk of exploitation. For example, use $validation->setRules(['email' => ['required','valid email, 'is unique[users.email,id,{id}]']]) to set validation rules.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BIT-CODEIGNITER-2023-32692

CVE-2023-32692

GHSA-M6M8-6GQ8-C9FJ

Produtos afetados

Codeigniter

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32692.json · Exploit
• https://github.com/codeigniter4/CodeIgniter4 · Nota
• https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md · Nota
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj · Aviso do Fabricante
• https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md#v435-2023-05-21 · Nota
• https://github.com/codeigniter4/CodeIgniter4/commit/6af677177fa1d9ad62f7a793bc96cba3068632ba · Nota
• https://t.me/pentestingnews/36236 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-32692 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32692 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-codeigniter-2023-32692 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-m6m8-6gq8-c9fj · Aviso do Fabricante