IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.4Yüksek

CVE-2025-14179SQL injection in pdo_firebird via NUL bytes in quoted strings

PHP Group PHP; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7 Yayım: (6 ay önce)

Açıklama

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

Zayıflık türü (CWE): CWE-89

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
PHP Group PHP 8.2.* – < 8.2.31, 8.3.* – < 8.3.31, 8.4.* – < 8.4.21, 8.5.* – < 8.5.6
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 —
Red Hat Red Hat Hardened Images —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (4)
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.31
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.31
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.21
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.6

Aynı üründe son açıklar — PHP

9.2Kritik
CVE-2026-109619 KEV

RCE via stale global state

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS
9.2Kritik
CVE-2026-109618 KEV

RCE via OOM corruption

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

100%EPSS