Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

CodeIgniter4 old() function can run attacker code

CVE-2022-21647 · published 4 years ago
Summary

The CodeIgniter4 web framework’s old() helper can be tricked into loading malicious data, allowing attackers to run PHP code and potentially cause database attacks. Update to version 4.1.6 or newer, or stop using old(), the form helper, and the redirect with input functions until you can upgrade. This prevents remote attackers from injecting harmful objects.

What to do
  • Update codeigniter4 framework to version 4.1.6.
  • Update codeigniter codeigniter to version 4.1.6 or later.
Affected software
Ecosystem VendorProductAffected versions
composer codeigniter4 framework < 4.1.6
Fix: upgrade to 4.1.6
– codeigniter codeigniter >= 4.0.0, < 4.1.6
cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*
Original advisory text
Deserialization of Untrusted Data in Codeigniter4
CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.7 High
Exploitation
38% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published4 Jan 2022
Updated20 Oct 2026
First seen6 Mar 2026
Sources
GHSA-w6jr-wj64-mc9x · GHSA
CVE-2022-21647 · NVD
CVE-2022-21647 · OSV
Track software like this
Free during beta