Lucene search
PRIOn knowledge basePRION:CVE-2022-21647HistoryJan 04, 2022 - 8:15 p.m.
Deserialization of untrusted data
2022-01-0420:15:00
PRIOn knowledge base
www.prio-n.com
10
CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the old() function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the old() function and form_helper nor RedirectResponse::withInput() and redirect()->withInput().
| CPE | Name | Operator | Version |
|---|---|---|---|
| codeigniter | ge | 4.0.0 | |
| codeigniter | lt | 4.1.6 |
Related
cve
cve
CVE-2022-21647
2022-01-04 20:15:07
osv
osv
Deserialization of Untrusted Data in Codeigniter4
2022-01-06 22:52:41
CVE-2022-21647
2022-01-04 20:15:07
BIT-codeigniter-2022-21647
2024-03-06 10:54:39
friendsofphp
friendsofphp
CVE-2022-21647: Deserialization of Untrusted Data in Codeigniter4
2022-01-04 00:59:31
CVE-2022-21647: Deserialization of Untrusted Data in Codeigniter4
2022-01-04 00:59:31
github
github
Deserialization of Untrusted Data in Codeigniter4
2022-01-06 22:52:41
cvelist
cvelist
CVE-2022-21647 Deserialization of Untrusted Data in Codeigniter4
2022-01-04 20:05:11
veracode
veracode
SQL Injection
2022-01-05 05:02:53
cnvd
cnvd
CodeIgniter code issues vulnerabilities
2022-01-06 00:00:00
nvd
nvd
CVE-2022-21647
2022-01-04 20:15:07