Flight PHP CVE-2026-42550

Application must use Flight PHP framework version < 3.18.1 with SimplePdo database helpers. The vulnerable code pattern requires the application to forward user-controlled associative arrays to SimplePdo::insert(), update(), or delete() methods-specifically, passing request payload data shapes without prior column name validation. The documented and common pattern $db->insert('users', $request->data->getData()) on signup/registration endpoints is the primary exposure. Remote network access to the vulnerable endpoint is required (AV:N). Attacker must have low-privilege authenticated access (PR:L), such as the ability to create a user account or submit data modification requests. No user interaction is required (UI:N). Applications hardcoding column names in static arrays before calling SimplePdo methods are NOT vulnerable-the attack surface is limited to dynamic data-shape forwarding. The $where parameter injection in update() and delete() methods is exploitable with any user input reaching those parameters. Default Flight PHP installations with SimplePdo usage are vulnerable; no special configuration disables the flaw. Exploitation is not limited by platform (SQLite, MySQL, PostgreSQL all affected as the vulnerability is pre-PDO at the query construction layer).

Real-world risk is HIGH for applications using the documented pattern of forwarding request payloads to SimplePdo methods. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity requiring only low-privilege authentication. No EPSS or KEV data provided, suggesting no confirmed mass exploitation yet, but the GitHub advisory with working proof-of-concept and commit diff confirms both vulnerability and patch. Attack complexity is genuinely low: a single crafted JSON request with malicious object keys achieves privilege escalation. The common framework pattern $db->insert('users', $request->data->getData()) on signup endpoints creates an instant administrative backdoor-high business impact despite requiring authenticated access. Scope is unchanged (S:U) but confidentiality, integrity, and availability impacts are all high (C:H/I:H/A:H) due to full database control post-exploitation. The availability of a clear remediation path (upgrade to 3.18.1) and the specificity of affected code paths (three methods in one class) make this actionable. The primary risk qualifier is whether applications actually pass user-controlled array shapes to these helpers; codebases using static column lists are not vulnerable, but the framework documentation encourages the vulnerable pattern. SSVC: exploitation is public (POC exists), automatable (single HTTP request), technical impact is total (arbitrary SQL execution). Priority for Flight PHP deployments with user registration or data modification endpoints.

An attacker registers a new user account on a Flight PHP application whose signup endpoint calls $db->insert('users', $request->data->getData()). The attacker crafts a JSON POST request with the body {"name, is_admin) VALUES (?, 1);-- ": "attacker_injected"}. The SimplePdo::insert() method extracts array keys as column names, generating INSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?). The SQL comment (--) truncates the remainder, leaving INSERT INTO users (name, is_admin) VALUES (?, 1) with a single placeholder bound to 'attacker_injected'. The database inserts a row with name='attacker_injected' and is_admin=1, granting immediate administrative privileges. The attacker logs in as the newly created admin user and accesses restricted functionality, exfiltrates sensitive data, or modifies other users' privileges. The proof-of-concept demonstrated this live on SQLite with observable database state changes.