PT-2024-40014 · Unknown · Codeigniter

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions CodeIgniter version 3.1.0 and earlier

Description A critical security issue was found in the ODBC database driver, which could lead to SQL injection. This issue has been mitigated with crucial fixes in the update. The query builder and escape() functions are no longer compatible with the ODBC driver due to these fixes. However, actual query binding has been introduced as a more secure alternative.

Recommendations For CodeIgniter version 3.1.0 and earlier, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the query builder and escape() functions with the ODBC driver until the update is applied. Restrict access to sensitive database operations to minimize the risk of exploitation.

Fix

Related Identifiers

GHSA-27QR-636M-WXG2

Affected Products

Codeigniter

References · 5

• https://osv.dev/vulnerability/GHSA-27qr-636m-wxg2 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter/framework/2016-07-26-1.yaml · Note
• https://github.com/simplysites/CodeIgniter · Note
• https://github.com/simplysites/CodeIgniter/commit/3d10ffa77854044570a1809a884776fd4bbd8b70 · Note
• https://forum.codeigniter.com/thread-65803.html · Note