CVE-2020-10793: CodeIgniter Privilege Escalation
Summary
CVE-2020-10793: CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. Affects codeigniter versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Also tracked for
- codeigniter4/framework · Packagist
The same CVE-2020-10793 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a popular open-source PHP framework used for developing web applications. It provides a lightweight and efficient way to build websites and web applications. However, CodeIgniter versions up to 4.0.0 are vulnerable to a privilege escalation vulnerability.
Vulnerability Detail
The vulnerability in CodeIgniter allows remote attackers to gain privileges by manipulating the Email ID on the "Select Role of the User" page. This can lead to unauthorized access and potential privilege escalation within the application. It is important to note that CodeIgniter itself does not provide a login screen or user management facilities beyond a Session library. The vulnerability is attributed to a custom module or plugin developed on top of CodeIgniter, rather than the framework itself.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As this vulnerability is related to a custom module or plugin, there is no specific workaround provided. However, it is recommended to disable or remove the affected module or plugin until a fix is available.
Conclusion
CodeIgniter versions up to 4.0.0 are vulnerable to a privilege escalation issue. It is important to review and update any custom modules or plugins developed on top of CodeIgniter to address this vulnerability. Following secure coding practices and keeping the framework up to date is crucial for maintaining the security of CodeIgniter-based applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for codeigniter →
FAQ
CodeIgniter is an open-source PHP framework used for developing web applications.
The vulnerability allows remote attackers to gain privileges, potentially leading to unauthorized access and privilege escalation within the application.
No, CodeIgniter itself does not provide a login screen or user management facilities beyond a Session library. The vulnerability is attributed to a custom module or plugin developed on top of CodeIgniter.
To fix this vulnerability, it is recommended to review and update the custom module or plugin responsible for the issue. Additionally, follow secure coding practices and keep CodeIgniter up to date.
As this vulnerability is related to a custom module or plugin, it is recommended to disable or remove the affected module or plugin until a fix is available.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter.
