CVE-2025-46337: SQL Injection Vulnerability in ADOdb PostgreSQL Driver
Summary
CVE-2025-46337: SQL injection in ADOdb PostgreSQL driver pg_insert_id() method. Affects adodb/adodb-php versions < 5.22.9. Fixed in 5.22.9. How to fix ↓
Also tracked for
- libphp-adodb · Debian:11
The same CVE-2025-46337 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ADOdb is a database abstraction library for PHP that provides a consistent interface for various database systems. It simplifies database interactions by allowing developers to write code that can work with multiple database types without needing to change the underlying SQL syntax. The library supports various databases, including PostgreSQL, MySQL, and SQLite, making it a popular choice for PHP developers. However, a critical vulnerability has been identified in the PostgreSQL driver, specifically in the pg_insert_id() method, which can lead to SQL injection attacks if not properly handled.
Vulnerability Detail
The vulnerability arises from improper escaping of a query parameter in the pg_insert_id() method of the ADOdb PostgreSQL driver. When user-supplied data is passed to this method without adequate validation or escaping, it allows an attacker to execute arbitrary SQL statements. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The severity of this vulnerability is classified as critical, with a CVSS score of 10.0, indicating a high risk to applications using affected versions of ADOdb.
How To Fix
Minimum fixed version
5.22.9
This is the first release that contains the fix.
composer require adodb/adodb-php:5.22.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that only controlled data is passed to the pg_insert_id() method's $fieldname parameter. Alternatively, you can escape the parameter using the pg_escape_identifier() function before passing it to pg_insert_id(). Here is an example of how to implement this workaround:
$fieldname = pg_escape_identifier($user_input);
$insert_id = $adodb->pg_insert_id($fieldname);
Conclusion
The SQL injection vulnerability in the ADOdb PostgreSQL driver poses a significant risk to applications using affected versions. It is crucial to update to the latest version to mitigate this risk. Implementing the recommended workarounds can provide temporary relief, but a full update is the best long-term solution.
See every vulnerability recorded for adodb/adodb-php →
FAQ
The vulnerability is an SQL injection flaw in the pg_insert_id() method of the ADOdb PostgreSQL driver, allowing attackers to execute arbitrary SQL commands.
Versions of ADOdb prior to 5.22.9 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement the recommended workaround by ensuring controlled data is passed to the pg_insert_id() method or by escaping the input.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data corruption, or complete control over the database.
References
Related vulnerabilities
Recent vulnerabilities recorded for adodb/adodb-php.
