ADOdb SQL Injection Vulnerability in adodb/adodb-php
Summary
GHSA-h63c-xvpf-264j: ADOdb SQL injection vulnerability. Affects adodb/adodb-php versions < 5.20.11. Fixed in 5.20.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ADOdb is a popular PHP library that provides a database abstraction layer for accessing databases. It offers support for various database drivers and is widely used in PHP applications. However, versions prior to 5.20.11 of the adodb/adodb-php package are vulnerable to SQL injection attacks.
Vulnerability Detail
The vulnerability in ADOdb arises from improper input sanitization in multiple drivers. This allows an attacker to inject malicious SQL queries into the application, potentially leading to unauthorized access, data manipulation, or data leakage. The vulnerability is classified as CWE-89 (SQL Injection) and has a critical severity rating.
How To Fix
Minimum fixed version
5.20.11
This is the first release that contains the fix.
composer require adodb/adodb-php:5.20.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to manually sanitize and validate user input before using it in SQL queries. This can be done by using prepared statements or parameterized queries, which ensure that user-supplied data is treated as data and not executable code. Here's an example of using prepared statements with ADOdb:
// Assuming $db is your ADOdb database connection
$query = 'SELECT * FROM users WHERE username = ? AND password = ?';
$statement = $db->Prepare($query);
$result = $db->Execute($statement, [$username, $password]);
Conclusion
The ADOdb SQL injection vulnerability in the adodb/adodb-php package can have serious security implications for PHP applications. It is crucial to upgrade to version 5.20.11 or higher to mitigate the risk. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for adodb/adodb-php →
FAQ
ADOdb is a PHP library that provides a database abstraction layer for accessing databases. It offers support for various database drivers and simplifies database operations in PHP applications.
SQL injection is a type of security vulnerability where an attacker can insert malicious SQL statements into an application's database query. This can lead to unauthorized access, data manipulation, or data leakage.
The ADOdb SQL injection vulnerability occurs due to improper input sanitization in multiple drivers. This allows an attacker to inject malicious SQL queries into the application, potentially leading to security breaches.
The impact of the ADOdb SQL injection vulnerability can be severe. Attackers can exploit this vulnerability to execute arbitrary SQL queries, potentially gaining unauthorized access to sensitive data, modifying data, or causing data leakage.
To protect your application from the ADOdb SQL injection vulnerability, it is recommended to upgrade the adodb/adodb-php package to version 5.20.11 or higher. Additionally, always sanitize and validate user input before using it in SQL queries, preferably by using prepared statements or parameterized queries.
References
Related vulnerabilities
Recent vulnerabilities recorded for adodb/adodb-php.
