BIT-php-min-2022-31631

vendorUSosv

PDO::quote() may return unquoted string

view advisory published 2025-02-20Licence: per source

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-31631US	—	2.19% (82nd)	—	2025-02-12
In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long strin…

references

External citations — patches, advisories, analysis.

https://bugs.php.net/bug.php?id=81740ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-31631WEB
https://security.netapp.com/advisory/ntap-20230223-0007/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan