CVE-2022-31631

PDO::quote() may return unquoted string

State: Published
Severity: 9.1 Critical
Published: Feb 12, 2025
Updated: Feb 13, 2025
Reserved: May 25, 2022

Description

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	php

Weaknesses

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
PHPPHP Group	8.0.x to before 8.0.27Affected 8.1.x to before 8.1.15Affected 8.2.x to before 8.2.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.