CodeIgniter SQL injection vulnerability

CodeIgniter is an open source web framework written in PHP. A SQL injection vulnerability exists in CodeIgniter version 3.1.13 and earlier versions, which stems from a SQL injection problem in the like method in the systemdatabaseDBquerybuilder.php location...

PT-2022-25564 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions =3.1.13 Description: The issue concerns SQL Injection via the like function in the system/database/DB query builder.php file. Note that the validity of this issue has been disputed by multiple third parties...

CVE-2022-40831

B.C. Institute of Technology CodeIgniter =3.1.13 is vulnerable to SQL Injection via system\database\DBquerybuilder.php like function. Note: Multiple third parties have disputed this as not a valid vulnerability...

CodeIgniter SQL injection vulnerability

CodeIgniter is an open source web framework written in PHP. A SQL injection vulnerability exists in CodeIgniter version 3.1.13 and earlier versions, which stems from a SQL injection problem in the having method in the systemdatabaseDBquerybuilder.php location...

PT-2022-25565 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions =3.1.13 Description: The issue concerns SQL Injection via the having function in the system/database/DB query builder.php file. Note that the validity of this issue has been disputed by multiple third parties...

CVE-2022-40830

B.C. Institute of Technology CodeIgniter =3.1.13 is vulnerable to SQL Injection via system\database\DBquerybuilder.php wherenotin function. Note: Multiple third parties have disputed this as not a valid vulnerability...

CVE-2022-40828

B.C. Institute of Technology CodeIgniter =3.1.13 is vulnerable to SQL Injection via system\database\DBquerybuilder.php orwherenotin function. Note: Multiple third parties have disputed this as not a valid vulnerability...

CVE-2022-40833

CVE-2022-40833 affects CodeIgniter versions <= 3.1.13. The underlying issue is an SQL injection in the or_where_in() function within system/database/DB_query_builder.php, leading to possible data disclosure/modification and service impact as reflected by the CVSS v3.1 base score of 9.8 (CRITIC...

CVE-2022-40829

CodeIgniter 3.x versions

CVE-2022-40832

CodeIgniter up to version 3.1.13 is affected by an SQL injection in the having() path of the DB query builder (system/database/DB_query_builder.php). The vulnerability is cited across multiple feeds (CodeIgniter <=3.1.13; some parties dispute its validity). Impact is described as SQL injection...

CVE-2022-39284

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting $secure or $httponly value to true in Config\Cookie is not reflected in setcookie or Response::setCookie. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does...

Code injection

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting $secure or $httponly value to true in Config\Cookie is not reflected in setcookie or Response::setCookie. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does...

CVE-2022-39284 Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting $secure or $httponly value to true in Config\Cookie is not reflected in setcookie or Response::setCookie. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does...

CVE-2022-39284: Improper Initialization

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting $secure or $httponly value to true in Config\Cookie is not reflected in setcookie or Response::setCookie. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does...

PT-2022-24868 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions prior to 4.2.7 Description: The issue arises when setting $secure or $httponly value to true in ConfigCookie is not reflected in set cookie or Response::setCookie, resulting in cookie values being erroneously exposed to...

CVE-2022-39284

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting "$secure" or "$httponly" value to "true" in "Config\Cookie" is not reflected in "setcookie" or "Response::setCookie". As a result cookie values are erroneously exposed to scripts. It should be noted that this...

CodeIgniter security vulnerabilities

CodeIgniter is an open source web framework written in the PHP language. A security vulnerability exists in CodeIgniter versions prior to 4.2.7 that stems from its incorrect configuration causing cookie values to be incorrectly publicized to scripts...

CVE-2022-39284

CodeIgniter 4 prior to v4.2.7 has a cookie handling bug where setting secure or HttpOnly (Config\Cookie) is not reflected in set_cookie() or Response::setCookie(), causing cookie values to be exposed to scripts. The vulnerability is limited to non-session cookies and does not affect sessions. Aff...

Multix 2.4 Cross Site Request Forgery Vulnerability

Exploit Title: Multix - Multipurpose Website CMS with Codeigniter Cross Site Request Forgery Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/multix-multipurpose-website-cms-with-codeigniter/23537596 Version: Version 2.4 Tested on Ubuntu...

Multix 2.4 Cross Site Scripting

Exploit Title: Multix - Multipurpose Website CMS with Codeigniter Reflected Cross Site Scripting Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/multix-multipurpose-website-cms-with-codeigniter/23537596 Version: Version 2.4 Tested on...