GHSA-3fj4-q72x-x2g9critical9.8
ADOdb Library SQL Injection
Impact
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
adodb/adodb-php Packagist
| Affected range | Recorded fix |
|---|---|
| From 5.0 before 5.20.7Ecosystem versions | 5.20.7 |
Version evidence: OSV · GHSA-3fj4-q72x-x2g9
View original version evidence (8 explicit versions)
Original source description
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2016-7405
- Source reference github.com/ADOdb/ADOdb/issues/226
- Patch github.com/ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8
- Release notes github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md
- Source reference lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y
- Source reference security.gentoo.org/glsa/201701-59
- Security advisory web.archive.org/web/20210123170727/http://www.securityfocus.com/bid/92969
- Security advisory www.openwall.com/lists/oss-security/2016/09/07/8
- Security advisory www.openwall.com/lists/oss-security/2016/09/15/1