CodeIgniter Query Builder SQL Injection Vulnerability Under Investigation
An SQL injection vulnerability in CodeIgniter's Query Builder deleteBatch() method when used with where() conditions is reportedly under investigation. Software engineers using CodeIgniter versions prior to 4.7.4 should assess their exposure.
What happened
A potential SQL injection vulnerability has been reported in the CodeIgniter Query Builder's deleteBatch() method when used in conjunction with where() conditions. This vulnerability appears to allow SQL injection if user-controlled input is passed to where() before calling deleteBatch(). The issue is reportedly affecting CodeIgniter versions prior to 4.7.4.
To assess your exposure, review your use of the deleteBatch() method with where() conditions. If user-controlled input is being passed to where() before calling deleteBatch(), your application may be vulnerable. It is recommended to upgrade to CodeIgniter v4.7.4 or later as a mitigation measure.
For more detailed information, consult the primary sources: [GHSA-c9w5-rwh3-7pm9](https://github.com/advisories/GHSA-c9w5-rwh3-7pm9) and [GHSA-mmj4-63m4-r6h5](https://github.com/advisories/GHSA-mmj4-63m4-r6h5). The severity of this issue is currently under investigation, and further details may become available as the investigation progresses.
How 0Day mitigates this
codeigniter4 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.