SQLite3 driver runs write queries via SQLite3::exec(), allowing stacked statements #10652

PHP Version

7.4.33

CodeIgniter4 Version

Reproduced on 4.0.4. The same execute() is present on current develop: https://github.com/codeigniter4/CodeIgniter4/blob/develop/system/Database/SQLite3/Connection.php

CodeIgniter4 Installation Method

Composer (manual)

Which operating systems have you tested for this bug?

macOS

Which server did you use?

cli

Environment

Development

Database

SQLite3

What happened?

CodeIgniter\Database\SQLite3\Connection::execute() runs write-type queries through SQLite3::exec(), which executes multiple ;-separated statements, while read queries go through single-statement SQLite3::query():

protected function execute(string $sql)
{
    return $this->isWriteType($sql)
        ? $this->connID->exec($sql)   // executes stacked statements
        : $this->connID->query($sql);
}

Query bindings are the correct defense, and this is not a vulnerability in the framework itself. But when application code concatenates untrusted input into a write query (a common mistake), the SQLite3 driver turns a single mistaken statement into stacked-query execution: an attacker can append ; DROP TABLE ..., or ; ATTACH DATABASE '/path/x.db' AS v; ... to create a file at an arbitrary writable path and read/write other SQLite databases the process can reach. Most other drivers do not execute stacked statements from a single mistaken write, so the blast radius here is larger and specific to this driver.

Steps to Reproduce

$db->query("CREATE TABLE t (id INTEGER PRIMARY KEY, name TEXT)");
$db->query("INSERT INTO t VALUES (1, 'a')");

$evil = "x'; CREATE TABLE marker(a); --";
// application code that forgot to bind the value:
$db->query("UPDATE t SET name = '{$evil}' WHERE id = 1");

// table `marker` now exists — the appended statement ran.

Expected Output

A single write query executes a single statement. Statements appended after ; inside the string should not be executed, matching the behavior of the read path (SQLite3::query()) and of other drivers.

Anything else?

Proposal (for discussion): route write-query execution through a single-statement path — for example SQLite3::query() plus SQLite3::changes() for the affected-row count, or a prepared statement — instead of exec().

Backward compatibility: some applications may intentionally run multiple ;-separated statements in a single write (schema / migration / seed scripts). If a single-statement write path is undesirable, documenting the stacked-statement behavior of the SQLite3 driver would still help users reason about the risk.