by Kastro
Paper/Archive/CVE-2025-46337

CVE-2025-46337

ADOdb ADOdb — SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

EPSS 0.7%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 54.7.547 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.

Affected

ProductAffectedFixed inSource
ADOdb< 5.22.9–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/ADOdb/ADOdb/security/advisories/GHSA-8x27-jwjr-8545refgithub.com/ADOdb/ADOdb/issues/1070refgithub.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426refxaliom.blogspot.com/2025/05/from-sast-to-cve-2025-46337.htmlreflists.debian.org/debian-lts-announce/2025/05/msg00029.html