CyberRota Analysis
AI-GeneratedThe vulnerability affects CodeIgniter versions 4.3.0 through 4.7.3, specifically in the deleteBatch() function, where user-controlled values can be improperly interpreted as SQL due to ignored escape flags. This critical flaw (CVSS 9.4) can lead to SQL injection attacks, potentially allowing attackers to manipulate or access sensitive data. Developers using affected versions should prioritize upgrading to version 4.7.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.