CVE-2025-46337 — SQL Injection in Adodb

CWE-89 — SQL Injection6 documents5 sources
Severity
10.0CRITICALNVD
EPSS
0.5%
top 33.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
AdodbAdodb Adodb-phpDebian Libphp-adodb
Timeline
PublishedMay 1
Latest updateMay 29

Description

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LExploitability: 3.9 | Impact: 6.0

Affected Packages3 packages

▶CVEListV5adodb/adodb< 5.22.9
▶Packagistadodb/adodb-php< 5.22.9
▶debiandebian/libphp-adodb< libphp-adodb 5.21.4-1+deb12u1 (bookworm)

🔴Vulnerability Details

3
OSV
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method↗2025-05-01
▶
GHSA
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method↗2025-05-01
▶
OSV
CVE-2025-46337: ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases↗2025-05-01
▶

📋Vendor Advisories

2
Ubuntu
ADOdb vulnerability↗2025-05-29
▶
Debian
CVE-2025-46337: libphp-adodb - ADOdb is a PHP database class library that provides abstractions for performing ...↗2025
▶