In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.
The PDO::quote() function is used to safely quote user-supplied data before passing it to an SQL query. When the provided string is too long, the SQLite driver in PHP quotes it incorrectly, causing data to escape the expected context. This results in the possibility of injecting arbitrary SQL instructions (SQL injection) into the query executed in the SQLite database.
An attacker can read or modify data stored in the SQLite database, bypassing protection mechanisms based on PDO::quote(). Consequently, unauthorized disclosure of sensitive data and manipulation of database contents is possible.
PHP should be updated to version 8.0.27 or newer (8.0 branch), 8.1.15 or newer (8.1 branch), or 8.2.2 or newer (8.2 branch). As a workaround, it is recommended to use parameterized queries (prepared statements) instead of manual data quoting via PDO::quote().
PHP in versions 8.0.x before 8.0.27, 8.1.x before 8.1.15, and 8.2.x before 8.2.2 — only when using the PDO driver with SQLite.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NPHP
APPPhp8.0.0 – 8.0.27 (excl.)8.1.0 – 8.1.15 (excl.)8.2.0 – 8.2.2 (excl.)Sqlite
APPSqlite≥ 3.39.2
Related vulnerabilities
PHP CGI argument injection – RCE na Windows przez mechanizm Best-Fit
RCE w PHP-CGI poprzez wstrzyknięcie opcji wiersza poleceń
Use-after-free w rozszerzeniu SOAP PHP umożliwiające RCE
PHP use-after-free przez __set lub ??= z wyjątkami — RCE
PHP: integer overflow w ldap_escape() prowadzący do out-of-bounds write