Vulnerability · Published May 30, 2023 · Assigned by GitHub_M
CVE-2023-32692Remote Code Execution Vulnerability in Validation Placeholders
Critical 9.8
In plain English
A critical-severity code injection in CodeIgniter4 from codeigniter4. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | codeigniter4/framework | 4.3.5 | GHSA-m6m8-6gq8-c9fj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| codeigniter4 | CodeIgniter4 | < 4.3.5 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H