CVE-2023-32692— Remote Code Execution Vulnerability in Validation Placeholders
In-the-Wild Activity Observed github_trending · low
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-32692
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote Code Execution Vulnerability in Validation Placeholders
Source: CVE Program / CVE List V5
Vulnerability Description
CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
CodeIgniter 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CodeIgniter是一款使用PHP语言编写的开源Web框架。 CodeIgniter 4.3.5之前版本存在安全漏洞，该漏洞源于控制器中的验证方法和模型内验证存在问题，允许攻击者执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| codeigniter4 | CodeIgniter4 | < 4.3.5 | - |
II. Public POCs for CVE-2023-32692
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-32692
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-32692 (1)
Other References for CVE-2023-32692 (1)
IV. Related Vulnerabilities
Same product: CodeIgniter4
- CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is - CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when usi - CVE-2026-63221
CodeIgniter: SQL injection is possible via Query Builder del - CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRe - CVE-2026-48062
CodeIgniter: Uploaded file extension validation bypass in `e
Same vendor: codeigniter4
- CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is - CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when usi - CVE-2026-63221
CodeIgniter: SQL injection is possible via Query Builder del - CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRe - CVE-2026-48062
CodeIgniter: Uploaded file extension validation bypass in `e
Same weakness: CWE-94
- CVE-2026-67340
ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scr - CVE-2026-16144
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution - CVE-2026-68770
sentence-transformers Arbitrary Code Execution on Local Mode - CVE-2026-53510
Savon::Model evaluates WSDL operation names as Ruby source - CVE-2026-17561
Unauthenticated RCE in Innotim Software's Logsign SIEM
V. Comments for CVE-2023-32692
No comments yet