Doctrine DBAL SQL injection possibility

Impact

The identifier quoting in Doctrine DBAL has a potential security problem when user-input is passed into this function, making the security aspect of this functionality obsolete. If you make use of AbstractPlatform::quoteIdentifier() or Doctrine::quoteIdentifier() please upgrade immediately. The ORM itself does not use identifier quoting in combination with user-input, however we still urge everyone to update to the latest version of DBAL.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Original source description

References

• Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/dbal/2011-09-25.yaml
• Source reference github.com/doctrine/dbal
• Security advisory web.archive.org/web/20130208100252/https://www.doctrine-project.org/blog/dbal-security-2011-1.html