CVE-2022-21647

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216486.1Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has CVE-2022-216495.4Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> ta CVE-2022-21654.3Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing CVE-2022-216505.4Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload CVE-2022-216516.1Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirect CVE-2022-216528.1Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a CVE-2022-216537.5Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't over CVE-2022-216549.8Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation CVE-2022-216557.5Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal CVE-2022-216565.9Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to impl CVE-2022-216576.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set CVE-2022-216586.3Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Se