PT-2022-15002 · Unknown · Codeigniter4

Mgatner · Published 2022-01-04 · Updated 2024-03-06 · CVE-2022-21647

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeIgniter4 versions prior to 4.1.6

Description Deserialization of Untrusted Data was found in the old() function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. A working exploit is known to exist, which can lead to SQL injection.

Recommendations Upgrade to v4.1.6 or later. As a temporary workaround, consider not using the old() function and form helper, nor RedirectResponse::withInput() and redirect()->withInput().

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-CODEIGNITER-2022-21647

CVE-2022-21647

GHSA-W6JR-WJ64-MC9X

Affected Products

Codeigniter4

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21647.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21647.yaml · Exploit
• https://github.com/codeigniter4/CodeIgniter4/commit/ce95ed5765256e2f09f3513e7d42790e0d6948f5 · Patch
• https://osv.dev/vulnerability/CVE-2022-21647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21647 · Security Note
• https://osv.dev/vulnerability/BIT-codeigniter-2022-21647 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6jr-wj64-mc9x · Vendor Advisory
• https://github.com/codeigniter4/CodeIgniter4 · Note
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-w6jr-wj64-mc9x · Note
• https://t.me/cibsecurity/34956 · Telegram Post