CVE-2023-32692 - CVE House

Back to Database

Status published Critical CVE-2023-32692

Remote Code Execution Vulnerability in Validation Placeholders

9.8 CVSS

Vulnerability Description

CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32692

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from codeigniter4

View All →

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

CodeIgniter validation of header name and value

CodeIgniter4 Language class DoS Vulnerability

Insertion of Sensitive Information into Log in codeigniter4/shield

Cleartext Storage of Sensitive Information in codeigniter4/shield

Affected Vendor

codeigniter4

View all reports →

Affected Software

CodeIgniter4

Vulnerable Versions:

< 4.3.5

Timeline

Official Publish: May 30th, 2023

Last Modified: January 10th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation