Doctrine SQL Injection Vulnerability in doctrine/orm
Summary
GHSA-6q9v-4hq6-5m67: Doctrine SQL injection vulnerability. Affects doctrine/orm across 2 version ranges.
>= 1.0.0, < 1.2.4
>= 2.0.0, < 2.0.3
Fixed in 1.2.4 or 2.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Doctrine is an object-relational mapping (ORM) library for PHP that provides a convenient way to interact with databases. It is widely used in PHP applications to simplify database operations and improve code maintainability. However, a SQL injection vulnerability has been discovered in Doctrine that could allow attackers to execute malicious SQL queries. This vulnerability affects versions 1.0.0 to 1.2.3 and 2.0.0 to 2.0.2 of the doctrine/orm package.
Vulnerability Detail
The vulnerability stems from a flaw in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery() function, which fails to properly cast input values for limit and offset to integers. This allows an attacker to inject malicious SQL code if these parameters are directly passed from request variables without prior casting to integers. The vulnerability also affects functionality built on top of the ORM, such as Doctrine\ORM\Query::setFirstResult() and Doctrine\ORM\Query::setMaxResults(). The impact of this vulnerability is that an attacker can manipulate the SQL queries executed by the application, potentially leading to unauthorized data access, data manipulation, or even remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.2.41.2.4composer require doctrine/orm:1.2.4 -
>= 2.0.0, < 2.0.32.0.3composer require doctrine/orm:2.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the doctrine/orm package to the fixed versions as soon as possible.
Conclusion
The SQL injection vulnerability in doctrine/orm can have severe consequences, allowing attackers to execute malicious SQL queries. It is crucial to update the package to the fixed versions to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for doctrine/orm →
FAQ
Doctrine is an object-relational mapping (ORM) library for PHP that simplifies database operations and improves code maintainability.
Versions 1.0.0 to 1.2.3 and 2.0.0 to 2.0.2 of the doctrine/orm package are affected by this vulnerability.
The vulnerability allows attackers to execute malicious SQL queries, potentially leading to unauthorized data access, data manipulation, or remote code execution.
To fix this vulnerability, update the doctrine/orm package to version 1.2.4 or later for versions 1.x and version 2.0.3 or later for versions 2.x.
No, there is no known workaround for this vulnerability. It is essential to update the doctrine/orm package to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for doctrine/orm.
