SQL Injection Vulnerability in ADOdb Library for PHP - libphp-adodb Package
Summary
CVE-2016-7405: The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting. Affects libphp-adodb across 2 version ranges.
< 5.20.6-1
< bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8
Fixed in 5.20.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ADOdb Library for PHP is a database abstraction library that provides a consistent interface for accessing various database systems. It is widely used in PHP applications for its ease of use and flexibility. However, versions prior to 5.20.7 contain a vulnerability in the PDO driver that can lead to SQL injection attacks, allowing attackers to manipulate database queries and potentially gain unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2016-7405, arises from the incorrect handling of quoting in the qstr method of the PDO driver within the ADOdb Library. This flaw can be exploited by remote attackers to execute arbitrary SQL queries, leading to data leakage, data manipulation, or even complete database compromise. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
5.20.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libphp-adodbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization to mitigate the risk of SQL injection. Ensure that all user inputs are properly escaped and validated before being used in SQL queries.
Conclusion
The CVE-2016-7405 vulnerability in the ADOdb Library for PHP poses a significant risk to applications using the libphp-adodb package. It is crucial to upgrade to the latest version to protect against potential SQL injection attacks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libphp-adodb →
FAQ
CVE-2016-7405 is a vulnerability in the ADOdb Library for PHP that allows for SQL injection attacks due to improper handling of quoting in the PDO driver.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and complete database compromise.
It is recommended to upgrade to version 5.20.6-1 or later of the libphp-adodb package to mitigate this vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libphp-adodb.
