CVE-2026-42550— Flight SQL注入漏洞

Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Flight SQL注入漏洞

Flight是Mike Cao个人开发者的一个PHP微框架。 Flight 3.18.1之前版本存在SQL注入漏洞，该漏洞源于SimplePdo::insert()、SimplePdo::update()和SimplePdo::delete()将$table参数和$data数组的键直接拼接至SQL语句，未进行标识符引用和验证，可能导致SQL注入。

N/A

N/A