GHSA-27qr-636m-wxg2
codeigniter/framework SQL injection in ODBC database driver
GHSA-27qr-636m-wxg2 is a critical vulnerability (CVSS 10.0) in codeigniter/framework, published May 15, 2024. No source lists public exploit code. Fixed in codeigniter/framework 3.1.0.
- Severity
- 10.0 CriticalCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.0codeigniter/framework +1 more
Description
CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This update includes crucial fixes to mitigate a SQL injection vulnerability, preventing potential exploitation by attackers. It is noteworthy that these fixes render the query builder and escape() functions incompatible with the ODBC driver. However, the update introduces actual query binding as a more secure alternative.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
codeigniter/frameworkPackagist | before 3.1.0 | 3.1.0 |
codeigniter/frameworkPackagist | before 3.1.0, plus listed versions 3.0.03.0.13.0.1rc3.0.1rc23.0.2 Show 7 moreShow less3.0.33.0.43.0.53.0.63.0rc3.0rc23.0rc3 | 3.1.0 |
What each source reports
GitHub Advisories Score used
codeigniter/framework SQL injection in ODBC database driver
CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This update includes crucial fixes to mitigate a SQL injection vulnerability, preventing potential exploitation by attackers. It is noteworthy that these fixes render the query builder and escape() functions incompatible with the ODBC driver. However, the update introduces actual query binding as a more secure alternative.
- Record
GHSA-27qr-636m-wxg2- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSV
codeigniter/framework SQL injection in ODBC database driver
CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This update includes crucial fixes to mitigate a SQL injection vulnerability, preventing potential exploitation by attackers. It is noteworthy that these fixes render the query builder and escape() functions incompatible with the ODBC driver. However, the update introduces actual query binding as a more secure alternative.
- Record
GHSA-27qr-636m-wxg2- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.