Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zZmo0LXE3MngteDJnOc4AAbZb

ADOdb Library SQL Injection

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.

Permalink: https://github.com/advisories/GHSA-3fj4-q72x-x2g9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZmo0LXE3MngteDJnOc4AAbZb
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 8 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3fj4-q72x-x2g9, CVE-2016-7405
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-7405
• https://github.com/ADOdb/ADOdb/issues/226
• https://github.com/ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8
• https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md
• https://lists.fedoraproject.org/archives/list/[email protected]/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y/
• https://security.gentoo.org/glsa/201701-59
• http://www.openwall.com/lists/oss-security/2016/09/07/8
• http://www.openwall.com/lists/oss-security/2016/09/15/1
• https://web.archive.org/web/20210123170727/http://www.securityfocus.com/bid/92969
• https://github.com/advisories/GHSA-3fj4-q72x-x2g9

Repository: https://github.com/ADOdb/ADOdb
Blast Radius: 24.4

Affected Packages