SQL Injection Vulnerability in libphp-adodb: Improper Escaping of Query Parameters

Background

libphp-adodb is a PHP database class library designed to provide abstractions for executing queries and managing various database systems. It supports multiple database types, including MySQL, PostgreSQL, and SQLite. The library is widely used in PHP applications for its ease of use and flexibility. However, certain versions of libphp-adodb have been found to be vulnerable to SQL injection attacks due to improper handling of query parameters when interacting with SQLite databases.

Vulnerability Detail

The vulnerability arises from improper escaping of a query parameter in versions 5.22.9 and below of libphp-adodb. When the library connects to a SQLite3 database and calls the metaColumns(), metaForeignKeys(), or metaIndexes() methods with a crafted table name, an attacker can execute arbitrary SQL statements. This can lead to unauthorized data access, data manipulation, or even complete database compromise, making it critical for users to address this issue promptly.

sudo apt-get install --only-upgrade libphp-adodb

Workaround

As a temporary workaround, ensure that only controlled data is passed to the $table parameter of the metaColumns(), metaForeignKeys(), and metaIndexes() methods. For example, validate and sanitize the input before passing it to these methods to prevent injection attacks. Here is a sample code snippet for validation:

if (preg_match('/^[a-zA-Z0-9_]+$/', $table)) {
    // Safe to use $table
} else {
    // Handle invalid table name
}

Conclusion

The SQL injection vulnerability in libphp-adodb poses significant risks to applications using affected versions. It is crucial for developers and system administrators to update to the patched version and implement the recommended workarounds to safeguard their databases from potential attacks.

See every vulnerability recorded for libphp-adodb →

FAQ