Description
ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ADOdb ADOdb
< 5.22.9affected
References
- https://github.com/ADOdb/ADOdb/security/advisories/GHSA-8x27-jwjr-8545 ↗
- https://github.com/ADOdb/ADOdb/issues/1070 ↗
- https://github.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426 ↗
- https://xaliom.blogspot.com/2025/05/from-sast-to-cve-2025-46337.html ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00029.html ↗