CVE-2022-40826: 
CodeIgniter vulnerability analysis and mitigation

CodeIgniter version 3.1.13 and earlier versions were found to be vulnerable to SQL Injection through the or_having() function in the system\database\DB_query_builder.php file. The vulnerability was identified and assigned CVE-2022-40826 (NVD).

The vulnerability exists in the query builder component of CodeIgniter, specifically in the or_having() function within the DB_query_builder.php file. The issue stems from insufficient filtering of query fields, which could allow malicious SQL injection attacks when developers incorrectly handle query fields from client input (GitHub Issue).

When exploited, this vulnerability could allow attackers to perform SQL injection attacks against applications built with affected versions of CodeIgniter. This could potentially lead to unauthorized access to or manipulation of the database.

Users should upgrade to a version newer than CodeIgniter 3.1.13 if available. Additionally, developers should ensure proper input validation and sanitization when handling database queries, particularly when dealing with user-supplied input in query fields.