CVE-2023-32692

CRITICAL9.8EPSS 1.8%

Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4

Published: 5/22/2023Modified: 3/6/2024

Also known as:GHSA-m6m8-6gq8-c9fjBIT-codeigniter-2023-32692

Description

CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.

Affected packages (2)

Bitnami/codeigniterfrom 0, < 4.3.5
Packagist/codeigniter4/frameworkfrom 0, < 4.3.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-32692
PATCHhttps://github.com/codeigniter4/CodeIgniter4
WEBhttps://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md
WEBhttps://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md#v435-2023-05-21
WEBhttps://github.com/codeigniter4/CodeIgniter4/commit/6af677177fa1d9ad62f7a793bc96cba3068632ba
WEBhttps://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj