CVE-2022-21647: 
PHP vulnerability analysis and mitigation

CVE-2022-21647 is a vulnerability discovered in CodeIgniter, an open source PHP full-stack web framework. The vulnerability was identified in the old() function in CodeIgniter4, involving Deserialization of Untrusted Data. This security flaw was disclosed on January 4, 2022, affecting all versions of CodeIgniter4 prior to version 4.1.6 (NVD, GitHub Advisory).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and received a CVSS v3.1 base score of 9.8 (Critical) from NIST NVD, while GitHub assessed it with a CVSS score of 7.7 (High). The issue specifically exists in the old() function, where untrusted data could be deserialized, potentially allowing attackers to inject auto-loadable arbitrary objects (NVD).

The vulnerability enables remote attackers to inject auto-loadable arbitrary objects, which could lead to execution of existing PHP code on the server. A working exploit was confirmed that could result in SQL injection attacks (GitHub Advisory).

The primary mitigation is to upgrade to CodeIgniter version 4.1.6 or later. For users unable to upgrade, the recommended workaround is to avoid using the old() function and form_helper, as well as RedirectResponse::withInput() and redirect()->withInput() (GitHub Advisory).