DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-63221: CVE-2026-63221: SQL Injection in CodeIgniter4 Query Builder deleteBatch()

#security #cve #cybersecurity

CVE-2026-63221: SQL Injection in CodeIgniter4 Query Builder deleteBatch()

Vulnerability ID: CVE-2026-63221
CVSS Score: 9.4
Published: 2026-08-07

An SQL injection vulnerability exists in the Query Builder component of the CodeIgniter4 full-stack PHP framework. The vulnerability is located within the compilation logic of the batch delete operation, deleteBatch(). When an application chains where() conditions prior to calling deleteBatch(), the Query Builder fails to enforce or respect the escaping flags of the parameters bound to the WHERE clauses. Instead of passing these parameters through the database driver standard escaping logic, the compilation engine interpolates the raw, unescaped bound values directly into the compiled SQL string, allowing remote attackers to execute arbitrary SQL commands.

TL;DR

CodeIgniter4 versions 4.3.0 through 4.7.3 contain an SQL injection flaw in the Query Builder's deleteBatch() component. When WHERE clauses are chained before a batch delete operation, the system fails to escape bound values, leading to unauthenticated SQL injection.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • Attack Vector: Network
  • CVSS v3.1 Score: 9.4 (Critical)
  • EPSS Score: 0.00377
  • EPSS Percentile: 30.46
  • Exploit Maturity: Proof of Concept / Analytical
  • CISA KEV Status: No

Affected Systems

  • CodeIgniter4 full-stack PHP framework deployments executing on PHP environments
  • CodeIgniter4: >= 4.3.0, < 4.7.4 (Fixed in: 4.7.4)

Code Analysis

Commit: f5e463b

Database fix for Query Builder deleteBatch()

--- a/system/Database/BaseBuilder.php
+++ b/system/Database/BaseBuilder.php
@@ -2362,9 +2362,5 @@
-    foreach ($this->QBWhere as $key => $where) {
-        foreach ($this->binds as $field => $bind) {
-            $this->QBWhere[$key]['condition'] = str_replace(':' . $field . ':', $bind[0], $where['condition']);
-        }
-    }
+    $this->convertWhereBindsForBatch();
Enter fullscreen mode Exit fullscreen mode

Commit: 953309e

Preventative hardening for updateBatch()

--- a/system/Database/BaseBuilder.php
+++ b/system/Database/BaseBuilder.php
@@ -2130,5 +2130,9 @@
+    if ($this->QBWhere !== []) {
+        throw new DatabaseException('You cannot use where() before updateBatch().');
+    }
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Security Advisory Tests: The advisory lists clear unit tests reproducing the exact SQL compile outputs showing unescaped strings when where() matches the parameter structure.

Mitigation Strategies

  • Upgrade CodeIgniter4 framework to version 4.7.4 or newer to incorporate corrected batch escaping methods.
  • Apply manual hotfixes to system/Database/BaseBuilder.php if immediate version upgrades are blocked by legacy dependencies.
  • Implement strict allowlist input validation rules on parameters bound to query builder conditions.

Remediation Steps:

  1. Update Composer configurations by executing 'composer update codeigniter4/framework' in the root folder.
  2. Confirm that system/CodeIgniter.php or composer.lock reports a version of 4.7.4 or higher.
  3. Search the application codebase for occurrences of deleteBatch() to verify if chained where() parameters are sourced from untrusted inputs.

References

Read the full report for CVE-2026-63221 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)