CVE-2022-24711: 
PHP vulnerability analysis and mitigation

CodeIgniter4, a PHP full-stack web framework, was found to contain an improper input validation vulnerability (CVE-2022-24711) prior to version 4.1.9. The vulnerability was discovered and disclosed on February 10, 2022, affecting all versions of CodeIgniter4 before 4.1.9. This critical security issue allows attackers to execute CLI (Command Line Interface) routes via HTTP requests (GitHub Advisory, CVE Mitre).

The vulnerability has been assigned a Critical severity rating with a CVSS v3.1 score of 9.4. The attack vector is Network-based, with low attack complexity, requiring no privileges or user interaction. The vulnerability is classified under CWE-20 (Improper Input Validation). The technical nature of the vulnerability allows attackers to execute CLI routes through HTTP requests, which should not be accessible via web interfaces (GitHub Advisory).

The vulnerability has significant impact potential, affecting the system's confidentiality (Low), integrity (High), and availability (High). The scope is unchanged, but the vulnerability allows unauthorized access to CLI functionality through web requests, which could lead to unauthorized command execution (GitHub Advisory).

The vulnerability was patched in CodeIgniter4 version 4.1.9, released on February 25, 2022. Users are strongly advised to upgrade to this version or later as there are no known workarounds for this vulnerability (CVE Mitre, GitHub Advisory).