SQL Injection Vulnerability in ADOdb Library (libphp-adodb) - CVE-2025-54119
Summary
CVE-2025-54119: ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Affects libphp-adodb versions < 5b8bd52cdcffefb4ecded1b399c98cfa516afe03. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ADOdb is a widely used PHP database class library that provides a set of abstractions for managing databases and executing queries. It supports multiple database types and is known for its ease of use and flexibility. However, versions 5.22.9 and below of the ADOdb library are vulnerable to a SQL injection attack due to improper escaping of query parameters, particularly when interacting with sqlite3 databases.
Vulnerability Detail
The vulnerability arises from the improper handling of user input in the ADOdb library, specifically when the metaColumns(), metaForeignKeys(), or metaIndexes() methods are called with a crafted table name. This flaw allows an attacker to execute arbitrary SQL statements, potentially leading to unauthorized data access or manipulation. The vulnerability is present in versions 5.22.9 and earlier, and it has been assigned the identifier CVE-2025-54119.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that only controlled data is passed to the $table parameter of the
metaColumns(), metaForeignKeys(), and metaIndexes() methods. For example, you can sanitize the input as follows: $table = preg_replace('/[^a-zA-Z0-9_]/', '', $userInput);
Conclusion
The CVE-2025-54119 vulnerability in the ADOdb library poses significant risks due to SQL injection possibilities. It is crucial for developers using affected versions to update to the latest version or implement the recommended workarounds to mitigate potential threats.
See every vulnerability recorded for libphp-adodb →
FAQ
CVE-2025-54119 is a vulnerability in the ADOdb library that allows for SQL injection attacks due to improper escaping of query parameters.
Versions 5.22.9 and below of the ADOdb library are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update the library right away, implement the suggested workaround by sanitizing user inputs before passing them to the vulnerable methods.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, data manipulation, or even complete database compromise.
Related vulnerabilities
Recent vulnerabilities recorded for libphp-adodb.
