p PatchFirst

CVE-2022-21647

CVE-2022-21647 · Deserialization of Untrusted Data in Codeigniter4

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.

CVSS 7.7 · High · EPSS 37.7% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • codeigniter4

    Versions
    • < 4.1.6: Affected

    No fix published

  • codeigniter4/framework Packagist

    Versions
    • 4.0.0
    • 4.0.0-rc.4
    • v4.0.0-alpha.3
    • v4.0.0-alpha.4
    • v4.0.0-alpha.5
    • v4.0.0-beta.1
    • v4.0.0-beta.2
    • v4.0.0-beta.3
    • v4.0.0-beta.4
    • v4.0.0-rc.1
    • v4.0.0-rc.2
    • v4.0.0-rc.2.1
    • v4.0.0-rc.3
    • v4.0.1
    • v4.0.2
    • v4.0.3
    • v4.0.4
    • v4.0.5
    • v4.1.0
    • v4.1.1
    • v4.1.2
    • v4.1.3
    • v4.1.4
    • v4.1.5
    Affected ranges
    • ECOSYSTEM: < 4.1.6

    Update to 4.1.6

Original sources

Check your server →