CVE-2023-32692

CRITICAL

CodeIgniter < 4.3.5 - Remote Code Execution via Validation Placeholders

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-32692. PoCs published by mogwailabs.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2023-32692, a code injection vulnerability in CodeIgniter 4 (versions 4.0.0 to 4.3.4). It includes a Dockerized environment with a vulnerable CodeIgniter 4 application, HTTP request templates for exploitation, and debugging configurations.

Description

CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.

Exploits (1)

nomisec WORKING POC

by mogwailabs · poc

https://github.com/mogwailabs/CVE-2023-32692-CodeIgniter4

View Code ZIP pw:eip

This repository contains a functional exploit PoC for CVE-2023-32692, a code injection vulnerability in CodeIgniter 4 (versions 4.0.0 to 4.3.4). It includes a Dockerized environment with a vulnerable CodeIgniter 4 application, HTTP request templates for exploitation, and debugging configurations.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: CodeIgniter 4 (4.0.0 to 4.3.4)

No auth needed

Prerequisites: Docker · VS Code (or compatible editor) · CodeIgniter 4 environment

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed May 19, 2026 Full analysis →

References (2)

Core 2

Core References

Mitigation, Vendor Advisory x_refsource_confirm

https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj

Release Notes x_refsource_misc

https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md

View Writeup ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0196

EPSS Percentile 83.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

codeigniter/codeigniter < 4.3.5

codeigniter4/framework 0 - 4.3.5Packagist

Published May 30, 2023

Tracked Since Feb 18, 2026