CVE-2023-32692
published 2023-05-30CVE-2023-32692: CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.12%
62.0th percentile
CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codeigniter | codeigniter | < 4.3.5 | 4.3.5 |
| codeigniter4 | codeigniter4 | < 4.3.5 | 4.3.5 |
| codeigniter4 | framework | >= 0 < 4.3.5 | 4.3.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
osv·2023-05-22
CVE-2023-32692 [CRITICAL] Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
### Impact
This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders.
The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally.
### Patches
Upgrade to v4.3.5 or later.
### Workarounds
Setting validation rules with an array.
E.g.:
```php
$validation->setRules([
'email' => ['required', 'valid_email, 'is_unique[users.email,id,{id}]'],
]);
```
### References
- https://codeigniter4.github.io/userguide/libraries/validation.html#validation-placeholders
- https://codeigniter4.github.io/userguide/incoming/controllers.html#validating-data
- https:
GHSA
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
ghsa·2023-05-22
CVE-2023-32692 [CRITICAL] CWE-94 Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
### Impact
This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders.
The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally.
### Patches
Upgrade to v4.3.5 or later.
### Workarounds
Setting validation rules with an array.
E.g.:
```php
$validation->setRules([
'email' => ['required', 'valid_email, 'is_unique[users.email,id,{id}]'],
]);
```
### References
- https://codeigniter4.github.io/userguide/libraries/validation.html#validation-placeholders
- https://codeigniter4.github.io/userguide/incoming/controllers.html#validating-data
- https:
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.mdhttps://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fjhttps://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.mdhttps://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj
2023-05-30
Published