A critical SQL injection flaw in the CodeIgniter4 framework enables unauthorized data manipulation through the deleteBatch function.

The vulnerability exists in the deleteBatch() method of the Query Builder, which fails to correctly handle escape flags for bound values. This allows an unauthenticated attacker to inject malicious SQL commands through input parameters.

The ability to perform SQL injection allows attackers to bypass application logic, access sensitive backend data, or potentially modify database contents. With a CVSS score of 9.4, this vulnerability poses a significant risk to application integrity and data security, necessitating urgent patching to prevent data breaches.

Immediate Action: Update the CodeIgniter4 framework to version 4.7.4 or later to resolve the improper neutralization of SQL elements.

Proactive Monitoring: Monitor web application logs for suspicious characters or SQL patterns in requests, particularly those interacting with batch deletion operations.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block incoming HTTP requests containing common SQL injection payloads.

Public Exploit Available: Unknown

Developers should prioritize upgrading to version 4.7.4 immediately. Given that this is a framework-level vulnerability, all applications utilizing affected versions of CodeIgniter4 are potentially at risk and should be patched without delay.