| Package | Affected versions | Patched versions |
|---|---|---|
| codeigniter4/framework | < 4.1.6 | 4.1.6 |
| codeigniter | ≥ 4.0.0, < 4.1.6 | 4.1.6 |
Deserialization of Untrusted Data was found in the old() function in CodeIgniter4.
Remote attackers may inject auto-loadable arbitrary objects with this vulnerability,
and possibly execute existing PHP code on the server.
We are aware of a working exploit, which can lead to SQL injection.
Upgrade to v4.1.6 or later.
Do not use:
old() and form_helperRedirectResponse::withInput() and redirect()->withInput()If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free