{"uuid": "eef6de6d-6bd6-488f-abf4-93f91785a88f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63221", "type": "seen", "source": "https://gist.github.com/alon710/888e29b3ee03ee26d9a2341be25e1c36", "content": "# CVE-2026-63221: CVE-2026-63221: SQL Injection in CodeIgniter4 Query Builder deleteBatch()\n\n> **CVSS Score:** 9.4\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63221\n\n## Summary\nAn SQL injection vulnerability exists in the Query Builder component of the CodeIgniter4 full-stack PHP framework. The vulnerability is located within the compilation logic of the batch delete operation, deleteBatch(). When an application chains where() conditions prior to calling deleteBatch(), the Query Builder fails to enforce or respect the escaping flags of the parameters bound to the WHERE clauses. Instead of passing these parameters through the database driver standard escaping logic, the compilation engine interpolates the raw, unescaped bound values directly into the compiled SQL string, allowing remote attackers to execute arbitrary SQL commands.\n\n## TL;DR\nCodeIgniter4 versions 4.3.0 through 4.7.3 contain an SQL injection flaw in the Query Builder's deleteBatch() component. When WHERE clauses are chained before a batch delete operation, the system fails to escape bound values, leading to unauthenticated SQL injection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.4 (Critical)\n- **EPSS Score**: 0.00377\n- **EPSS Percentile**: 30.46\n- **Exploit Maturity**: Proof of Concept / Analytical\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- CodeIgniter4 full-stack PHP framework deployments executing on PHP environments\n- **CodeIgniter4**: >= 4.3.0, < 4.7.4 (Fixed in: `4.7.4`)\n\n## Mitigation\n\n- Upgrade CodeIgniter4 framework to version 4.7.4 or newer to incorporate corrected batch escaping methods.\n- Apply manual hotfixes to system/Database/BaseBuilder.php if immediate version upgrades are blocked by legacy dependencies.\n- Implement strict allowlist input validation rules on parameters bound to query builder conditions.\n\n**Remediation Steps:**\n1. Update Composer configurations by executing 'composer update codeigniter4/framework' in the root folder.\n2. Confirm that system/CodeIgniter.php or composer.lock reports a version of 4.7.4 or higher.\n3. Search the application codebase for occurrences of deleteBatch() to verify if chained where() parameters are sourced from untrusted inputs.\n\n## References\n\n- [CVE-2026-63221 Reference Record](https://www.cve.org/CVERecord?id=CVE-2026-63221)\n- [NVD CVE-2026-63221 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-63221)\n- [CodeIgniter4 Security Advisory GHSA-c9w5-rwh3-7pm9](https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9)\n- [CodeIgniter4 Release v4.7.4 Changelog](https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63221) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T05:33:08.986165Z"}