High severityNVD Advisory· Published Jan 4, 2022· Updated Apr 23, 2025
Deserialization of Untrusted Data in Codeigniter4
CVE-2022-21647
Description
CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the old() function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the old() function and form_helper nor RedirectResponse::withInput() and redirect()->withInput().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
codeigniter4/frameworkPackagist | < 4.1.6 | 4.1.6 |
Affected products
3- osv-coords2 versions
>= 4.0.0, < 4.1.6+ 1 more
- (no CPE)range: >= 4.0.0, < 4.1.6
- (no CPE)range: < 4.1.6
- Range: < 4.1.6
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-w6jr-wj64-mc9xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-21647ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21647.yamlghsaWEB
- github.com/codeigniter4/CodeIgniter4/commit/ce95ed5765256e2f09f3513e7d42790e0d6948f5ghsax_refsource_MISCWEB
- github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-w6jr-wj64-mc9xghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.