CVE-2022-40827: CodeIgniter SQL Injection Vulnerability
Summary
CVE-2022-40827: B.C. Institute of Technology CodeIgniter. Affects codeigniter across 5 version ranges.
>= 3.0-rc.0, <= 3.0-rc.0
>= 3.0-rc2.0, <= 3.0-rc2.0
>= 3.0-rc3.0, <= 3.0-rc3.0
>= 3.0.0, < 3.1.13
>= 3.0.0, <= 3.0.0
Fixed in 3.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CodeIgniter is an open-source PHP framework that is widely used for developing web applications. It provides a set of libraries and tools to simplify the development process and enhance security. However, versions up to 3.1.13 of CodeIgniter are vulnerable to SQL Injection attacks through the 'where()' function in the 'system/database/DB_query_builder.php' file. This vulnerability allows an attacker to manipulate SQL queries and potentially gain unauthorized access to the database.
Vulnerability Detail
The SQL Injection vulnerability in CodeIgniter arises due to insufficient input validation in the 'where()' function. Attackers can exploit this vulnerability by injecting malicious SQL code into user-supplied input, which is not properly sanitized. As a result, the injected SQL code gets executed by the database, leading to unauthorized data retrieval, modification, or deletion. This vulnerability has a critical severity score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How To Fix
Minimum fixed version
3.1.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize user input before passing it to the 'where()' function. This can be done by using appropriate sanitization functions or prepared statements to ensure that the input is treated as data and not executable code. Here's an example of how to sanitize user input in CodeIgniter:
$userInput = $this->input->post('user_input');
$sanitizedInput = $this->db->escape($userInput);
$this->db->where('column_name', $sanitizedInput);
Conclusion
The SQL Injection vulnerability in CodeIgniter can have severe consequences, allowing attackers to manipulate SQL queries and potentially compromise sensitive data. It is crucial for developers to upgrade to the latest version of CodeIgniter and implement proper input validation to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter →
FAQ
CodeIgniter is an open-source PHP framework used for developing web applications. It provides a set of libraries and tools to simplify the development process and enhance security.
SQL Injection is a type of security vulnerability where an attacker can manipulate SQL queries by injecting malicious code. This can lead to unauthorized access, data leakage, or data manipulation.
The SQL Injection vulnerability in CodeIgniter allows attackers to execute arbitrary SQL queries, potentially gaining unauthorized access to the database and compromising sensitive data.
Yes, the vulnerability can be fixed by upgrading CodeIgniter to version 3.1.14 or higher. The latest version includes a patch that addresses the SQL Injection issue.
Developers should implement proper input validation and use parameterized queries to prevent SQL Injection attacks. It is also important to keep CodeIgniter and its dependencies up to date.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
