CVE-2025-14179

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.30 PHP versions 8.3.0 through 8.3.30 PHP versions 8.4.0 through 8.4.20 PHP versions 8.5.0 through 8.5.5

Description The PDO Firebird driver improperly handles NUL bytes during the preparation of SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied using the strncat() function, which terminates at the NUL byte. This action drops the closing quote, causing subsequent SQL tokens to be interpreted as part of the string. This behavior enables SQL injection when attacker-controlled values are processed via the PDO::quote() function and embedded in SQL statements.

Recommendations Update to version 8.2.31 or later. Update to version 8.3.31 or later. Update to version 8.4.21 or later. Update to version 8.5.6 or later.