Executive brief
The Flight PHP framework contains a vulnerability in its database helper component that could allow an attacker to execute unauthorized database commands. By sending specially crafted data to applications using this framework, an attacker could gain administrative privileges, modify sensitive records, or delete entire database tables. This poses a significant risk to data integrity and confidentiality for any application built on the affected versions of the framework.
Technical details
A SQL injection vulnerability exists in the `SimplePdo` class of the Flight PHP framework. The `insert()`, `update()`, and `delete()` methods construct SQL statements by directly concatenating table names and array keys from the `$data` parameter without proper identifier quoting or validation. An attacker can exploit this by providing malicious array keys (e.g., via JSON input) that break out of the intended SQL structure. This can lead to privilege escalation, arbitrary data modification, or data exfiltration. The issue is fixed in version 3.18.1 by introducing a `requireSafeIdentifier()` helper that validates identifiers against a strict alphanumeric pattern.
Affected products
- FlightPHP Flight (flightphp/core) < 3.18.1
Timeline
- 2026-04-29: disclosed: Vulnerability reported and reviewed on GitHub
- 2026-04-29: patched: Fixed in version 3.18.1 via commit b8dd23a
- 2026-05-06: advisory: GitHub Advisory GHSA-xwqr-rcqg-22mr published