Vulnerabilities (CVE)

Filtered by vendor Codeigniter Subscribe
Filtered by product Codeigniter
Total 36 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-46240 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 7.5 HIGH
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.
CVE-2023-32692 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.
CVE-2022-46170 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.
CVE-2022-23556 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 7.5 HIGH
CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.
CVE-2022-40827 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function.
CVE-2022-40825 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function.
CVE-2022-40832 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function.
CVE-2022-40835 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php.
CVE-2022-35943 1 Codeigniter 2 Codeigniter, Shield 2023-12-10 N/A 8.8 HIGH
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)
CVE-2022-40831 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function.
CVE-2022-40830 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function.
CVE-2022-39284 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 4.3 MEDIUM
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.
CVE-2022-40828 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function.
CVE-2022-40834 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function.
CVE-2022-40826 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function.
CVE-2022-40824 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function.
CVE-2022-40833 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function.
CVE-2022-40829 1 Codeigniter 1 Codeigniter 2023-12-10 N/A 9.8 CRITICAL
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function.
CVE-2022-24711 1 Codeigniter 1 Codeigniter 2023-12-10 7.5 HIGH 9.8 CRITICAL
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
CVE-2022-24712 1 Codeigniter 1 Codeigniter 2023-12-10 6.8 MEDIUM 8.8 HIGH
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability, but users will still need to code as these after upgrading to v4.1.9. Otherwise, the CSRF protection may be bypassed. If auto-routing is enabled, check the request method in the controller method before processing. If auto-routing is disabled, either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the request method in the controller method before processing.