Skip to main content

PHP PDO Firebird CVE-2025-14179

| EUVDEUVD-2025-209755 HIGH
SQL Injection (CWE-89)
2026-05-10 php
PHP SQLi
7.4
CVSS 4.0 · Vendor: php
Share

Severity by source

Vendor (php) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber
SUSE
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (php).

CVSS VectorVendor: php

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

5
Analysis Generated
May 10, 2026 - 07:30 vuln.today
Patch available
May 10, 2026 - 06:01 EUVD
CVSS changed
May 10, 2026 - 05:22 NVD
7.4 (HIGH)
CVE Published
May 10, 2026 - 03:51 nvd
UNKNOWN (no severity yet)
CVE Published
May 10, 2026 - 03:51 nvd
HIGH 7.4

DescriptionCVE.org

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

AnalysisAI

SQL injection in PHP's PDO Firebird driver allows remote attackers to manipulate database queries when applications use PDO::quote() with attacker-controlled input containing NUL bytes. The vulnerability affects PHP versions 8.2.* through 8.5.* across all maintained branches, with vendor patches released (8.2.31, 8.3.31, 8.4.21, 8.5.6). CVSS 7.4 with network attack vector but requires user interaction and precise timing conditions (AT:P). Proof-of-concept exploitation status confirmed (E:P), though no active exploitation identified in CISA KEV at time of analysis.

Technical ContextAI

The vulnerability resides in PHP's PDO (PHP Data Objects) Firebird driver, specifically in the query preparation mechanism. When constructing SQL queries token-by-token, the driver uses strncat() to copy string tokens. This C standard library function terminates copying at the first NUL byte (0x00), creating a premature string termination. If an attacker-controlled value containing a NUL byte is passed through PDO::quote() - a function designed to safely escape values for SQL inclusion - the closing quote is dropped from the concatenated query string. Subsequent SQL tokens are then interpreted as part of the string literal rather than as SQL syntax, effectively breaking out of the quoted context. This is a classic CWE-89 SQL injection variant arising from improper neutralization of special elements, specifically exploiting the semantic gap between PHP's length-aware strings and C's NUL-terminated strings. The PDO Firebird driver is less commonly deployed than MySQL or PostgreSQL drivers, limiting real-world exposure. CPE cpe:2.3:a:php_group:php indicates the core PHP interpreter packages across distributions are affected when PDO Firebird support is compiled in.

RemediationAI

Upgrade PHP to patched versions: 8.2.31 or later for 8.2 branch, 8.3.31 or later for 8.3 branch, 8.4.21 or later for 8.4 branch, or 8.5.6 or later for 8.5 branch. Patches address the NUL byte handling in PDO Firebird's query tokenizer. For environments where immediate patching is not feasible: (1) Replace manual query construction using PDO::quote() with parameterized prepared statements using PDO::prepare() and bound parameters via execute(), which are not affected by this tokenization vulnerability - side effect is code refactoring requirement; (2) If PDO Firebird is not required by the application, disable or remove the PDO Firebird extension from PHP build/configuration to eliminate attack surface - side effect is potential application breakage if future code relies on Firebird; (3) Implement input validation to reject or strip NUL bytes (0x00) from user input before database operations - less reliable as defense-in-depth since validation logic may be bypassed or incomplete. Primary remediation is upgrading to fixed versions per vendor advisory https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2015-7297 HIGH POC
7.5

Same technique SQLi

View all
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5
CVE-2015-7297 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2025-14179 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy