| Package | Affected versions | Patched versions |
|---|---|---|
| codeigniter4/framework | < 4.3.5 | 4.3.5 |
| codeigniter | < 4.3.5 | 4.3.5 |
This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders.
The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally.
Upgrade to v4.3.5 or later.
Setting validation rules with an array.
E.g.:
$validation->setRules([
'email' => ['required', 'valid_email, 'is_unique[users.email,id,{id}]'],
]);
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free