← CVE Intelligence

CVE-2022-31631

PDO::quote() may return unquoted string PUBLISHED

Description (CNA)

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

Affected (CNA)

Vendor / productVersions
PHP Group / PHPaffected 8.0.x before 8.0.27; affected 8.1.x before 8.1.15; affected 8.2.x before 8.2.2

CWE

CWE-74

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.