SQL Injection Risk in PHP SQLite Driver for PHP Versions
CVE-2022-31631
9.1CRITICAL
Summary
A vulnerability exists in PHP's PDO::quote() function for the SQLite driver, affecting multiple versions of PHP. When user-supplied data is processed, excessive length in input strings can lead to incorrect quoting of data. This flaw exposes applications to potential SQL injection attacks, allowing malicious actors to manipulate database queries. Users are encouraged to update to secure versions to mitigate this serious risk.
Affected Version(s)
PHP 8.0.x
PHP 8.0.x < 8.0.27
PHP 8.1.x < 8.1.15
References
CVSS V3.1
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved