CVE-2025-46337
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.
Reserved 2025-04-22 | Published 2025-05-01 | Updated 2025-05-26 | Assigner GitHub_MCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
github.com/.../ADOdb/security/advisories/GHSA-8x27-jwjr-8545
github.com/ADOdb/ADOdb/issues/1070
github.com/...ommit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426
Support options
