PT-2023-23966 · Unknown · Codeigniter

Kenjis · Published 2023-05-22 · Updated 2024-03-06 · CVE-2023-32692

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.3.5

Description This issue allows attackers to execute arbitrary code when using Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also affected because they use the Validation library internally.

Recommendations For versions prior to 4.3.5, upgrade to version 4.3.5 or later. As a temporary workaround, consider setting validation rules with an array to minimize the risk of exploitation. For example, use $validation->setRules(['email' => ['required','valid email, 'is unique[users.email,id,{id}]']]) to set validation rules.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-CODEIGNITER-2023-32692

CVE-2023-32692

GHSA-M6M8-6GQ8-C9FJ

Affected Products

Codeigniter

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32692.json · Exploit
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6m8-6gq8-c9fj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32692 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32692 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-codeigniter-2023-32692 · Vendor Advisory
• https://github.com/codeigniter4/CodeIgniter4 · Note
• https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md · Note
• https://github.com/codeigniter4/CodeIgniter4/commit/6af677177fa1d9ad62f7a793bc96cba3068632ba · Note
• https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md#v435-2023-05-21 · Note
• https://t.me/pentestingnews/36236 · Telegram Post