Critical SQL Injection Vulnerability in libphp-adodb Package
Summary
USN-7530-1: libphp-adodb vulnerability. Affects libphp-adodb versions < 5.22.8-0.1ubuntu0.1. Fixed in 5.22.8-0.1ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libphp-adodb is a PHP library that provides a database abstraction layer, allowing developers to interact with various database systems using a unified API. It is widely used in PHP applications for its ease of use and flexibility. However, a recent vulnerability has been identified that compromises its security, specifically related to how it handles SQL input.
Vulnerability Detail
The vulnerability, identified as CVE-2025-46337, arises from improper handling of SQL input within the ADOdb library. This flaw allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, or complete system compromise. The issue is particularly concerning as it can be exploited without authentication, making it a critical risk for applications relying on this library.
How To Fix
Minimum fixed version
5.22.8-0.1ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libphp-adodbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers are advised to sanitize all SQL inputs manually and implement prepared statements to mitigate the risk of SQL injection until the package can be updated.
Conclusion
The libphp-adodb package has a critical vulnerability that allows SQL injection attacks, posing significant risks to applications using it. It is crucial to update to the latest patched version to safeguard against potential exploits. Additionally, implementing best practices for SQL input handling can further enhance security.
See every vulnerability recorded for libphp-adodb →
FAQ
The vulnerability allows remote attackers to execute arbitrary SQL commands due to improper handling of SQL input.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data manipulation, or complete system compromise.
Yes, a patched version of the libphp-adodb package is available. Updating to version 5.22.8-0.1ubuntu0.1 will resolve the issue.
If an immediate update is not possible, ensure to sanitize SQL inputs and use prepared statements as a temporary measure to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for libphp-adodb.
