Threats tagged 'ghsa-c9w5-rwh3-7pm9'

A critical SQL injection vulnerability exists in CodeIgniter 4's Query Builder deleteBatch() method when used with where() conditions. The vulnerability arises because bound values from the WHERE clause are directly substituted into the SQL query without proper escaping or quoting. This allows user-controlled input passed to where() before deleteBatch() to be interpreted as SQL code, enabling injection attacks. The issue affects versions from 4.3.0 up to but not including 4.7.4. A fix is available in version 4.7.4. Workarounds include strict input validation and avoiding user-controlled input in where() when using deleteBatch().