GHSA-XWQR-RCQG-22MR

Vulnerability from github – Published: 2026-05-06 21:35 – Updated: 2026-05-14 20:40
VLAI
Summary
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Details

Summary

SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys.

Affected code

flight/database/SimplePdo.php:

// insert (≈ 320-373)
$sql = sprintf(
    "INSERT INTO %s (%s) VALUES (%s)",
    $table,                            // raw concat
    implode(', ', $columns),           // raw array_keys($data)
    implode(', ', $placeholders)
);

// update (≈ 397-409)
$sets[] = "$column = ?";               // $column = user-controlled key
$sql = sprintf(
    "UPDATE %s SET %s WHERE %s",
    $table,                            // raw
    implode(', ', $sets),
    $where
);

// delete (≈ 427-429)
$sql = "DELETE FROM $table WHERE $where";

No identifier-quoting helper exists; neither $table nor the data keys are validated against a safe-identifier pattern.

Proof of concept

A controller does:

$db->insert('users', $request->data->getData());

The attacker sends the JSON body:

{"name, is_admin) VALUES (?, 1);-- ": "attacker_injected"}

Generated SQL:

INSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?)

After the -- comment, the effective statement INSERT INTO users (name, is_admin) VALUES (?, 1) binds the single placeholder 'attacker_injected', yielding a row with is_admin = 1.

Reproduced live on an in-memory sqlite database (testproj/sqli_live2.php):

id=1  name=alice              is_admin=0
id=2  name=attacker_injected  is_admin=1   <-- injected insert

UPDATE injection via the $where parameter was also reproduced: $db->update('users', ['is_admin' => 1], "id = 1 OR 1=1") flips admin on every row.

Impact

  • Privilege escalation on any signup / register endpoint that forwards request data to insert() (attacker creates an administrative account in a single request).
  • Arbitrary column write through update() keys.
  • Data destruction and exfiltration through the $where parameter (DELETE FROM users WHERE 1=1, UNION-based exfil, etc.).

Patch (fixed in 3.18.1, commit b8dd23a)

A new requireSafeIdentifier() helper validates table names and column names against ^[A-Za-z_][A-Za-z0-9_]*$ before they are interpolated into the SQL string. The $where parameter remains raw SQL as documented — parameterized values passed alongside it continue to be bound safely.

Credit

Discovered by @Rootingg.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "flightphp/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T21:35:55Z",
    "nvd_published_at": "2026-05-13T20:16:22Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`SimplePdo::insert()`, `SimplePdo::update()`, and `SimplePdo::delete()` build SQL statements by concatenating the `$table` argument and the **keys** of the `$data` array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers \u2014 a common and documented pattern, e.g. `$db-\u003einsert(\u0027users\u0027, $request-\u003edata-\u003egetData())` \u2014 an attacker can inject arbitrary SQL by crafting malicious array keys.\n\n### Affected code\n`flight/database/SimplePdo.php`:\n\n```php\n// insert (\u2248 320-373)\n$sql = sprintf(\n    \"INSERT INTO %s (%s) VALUES (%s)\",\n    $table,                            // raw concat\n    implode(\u0027, \u0027, $columns),           // raw array_keys($data)\n    implode(\u0027, \u0027, $placeholders)\n);\n\n// update (\u2248 397-409)\n$sets[] = \"$column = ?\";               // $column = user-controlled key\n$sql = sprintf(\n    \"UPDATE %s SET %s WHERE %s\",\n    $table,                            // raw\n    implode(\u0027, \u0027, $sets),\n    $where\n);\n\n// delete (\u2248 427-429)\n$sql = \"DELETE FROM $table WHERE $where\";\n```\n\nNo identifier-quoting helper exists; neither `$table` nor the data keys are validated against a safe-identifier pattern.\n\n### Proof of concept\nA controller does:\n```php\n$db-\u003einsert(\u0027users\u0027, $request-\u003edata-\u003egetData());\n```\n\nThe attacker sends the JSON body:\n```json\n{\"name, is_admin) VALUES (?, 1);-- \": \"attacker_injected\"}\n```\n\nGenerated SQL:\n```sql\nINSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?)\n```\n\nAfter the `--` comment, the effective statement `INSERT INTO users (name, is_admin) VALUES (?, 1)` binds the single placeholder `\u0027attacker_injected\u0027`, yielding a row with `is_admin = 1`.\n\nReproduced live on an in-memory sqlite database (`testproj/sqli_live2.php`):\n\n```\nid=1  name=alice              is_admin=0\nid=2  name=attacker_injected  is_admin=1   \u003c-- injected insert\n```\n\n`UPDATE` injection via the `$where` parameter was also reproduced: `$db-\u003eupdate(\u0027users\u0027, [\u0027is_admin\u0027 =\u003e 1], \"id = 1 OR 1=1\")` flips admin on every row.\n\n### Impact\n- **Privilege escalation** on any signup / register endpoint that forwards request data to `insert()` (attacker creates an administrative account in a single request).\n- Arbitrary column write through `update()` keys.\n- Data destruction and exfiltration through the `$where` parameter (`DELETE FROM users WHERE 1=1`, UNION-based exfil, etc.).\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `requireSafeIdentifier()` helper validates table names and column names against `^[A-Za-z_][A-Za-z0-9_]*$` before they are interpolated into the SQL string. The `$where` parameter remains raw SQL as documented \u2014 parameterized values passed alongside it continue to be bound safely.\n\n### Credit\nDiscovered by **@Rootingg**.",
  "id": "GHSA-xwqr-rcqg-22mr",
  "modified": "2026-05-14T20:40:00Z",
  "published": "2026-05-06T21:35:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/flightphp/core/security/advisories/GHSA-xwqr-rcqg-22mr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42550"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flightphp/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flightphp/core/releases/tag/v3.18.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.