Security Digest · Critical advisory (no CVE assigned)
GHSA-27qr-636m-wxg2: codeigniter/framework SQL injection in ODBC database driver
CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver.
CVSS 10.0 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | codeigniter/framework | < 3.1.0 | 3.1.0 |
Details
CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This update includes crucial fixes to mitigate a SQL injection vulnerability, preventing potential exploitation by attackers. It is noteworthy that these fixes render the query builder and escape() functions incompatible with the ODBC driver. However, the update introduces actual query binding as a more secure alternative.
CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Sources and references
- GitHub Advisory GHSA-27qr-636m-wxg2 github.com
- github.com github.com
- forum.codeigniter.com forum.codeigniter.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest