CVE-2016-7405 ADOdb Library SQL Injection
CriticalCVSS 9.8
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| adodb/adodb-php(Packagist) | >= 5.0, < 5.20.7 | 5.20.7 |
| adodb/adodb-php(Packagist) | = v5.19 | No fix listed |
| adodb/adodb-php(Packagist) | = v5.20.0 | No fix listed |
| adodb/adodb-php(Packagist) | = v5.20.1 | No fix listed |
| adodb/adodb-php(Packagist) | = v5.20.2 | No fix listed |
| adodb/adodb-php(Packagist) | = v5.20.3 | No fix listed |
| adodb/adodb-php(Packagist) | = v5.20.4 | No fix listed |
| adodb/adodb-php(Packagist) | = v5.20.5 | No fix listed |
| adodb/adodb-php(Packagist) | = v5.20.6 | No fix listed |
| debian/libphp-adodb(Debian:12) | < 5.20.6-1 | 5.20.6-1 |
| debian/libphp-adodb(Debian:14) | < 5.20.6-1 | 5.20.6-1 |
| debian/libphp-adodb(Debian:13) | < 5.20.6-1 | 5.20.6-1 |
| adodb project adodb | = 5.00-beta | No fix listed |
| adodb project adodb | = 5.01-beta | No fix listed |
| adodb project adodb | = 5.02 | No fix listed |
| adodb project adodb | = 5.02-a | No fix listed |
| adodb project adodb | = 5.03 | No fix listed |
| adodb project adodb | = 5.04 | No fix listed |
| adodb project adodb | = 5.04-a | No fix listed |
| adodb project adodb | = 5.05 | No fix listed |
| adodb project adodb | = 5.06 | No fix listed |
| adodb project adodb | = 5.06-a | No fix listed |
| adodb project adodb | = 5.07 | No fix listed |
| adodb project adodb | = 5.08 | No fix listed |
| adodb project adodb | = 5.08-a | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| adodb project adodb | = 5.09 | No fix listed |
| adodb project adodb | = 5.09-a | No fix listed |
| adodb project adodb | = 5.10 | No fix listed |
| adodb project adodb | = 5.11 | No fix listed |
| adodb project adodb | = 5.12 | No fix listed |
| adodb project adodb | = 5.13 | No fix listed |
| adodb project adodb | = 5.14 | No fix listed |
| adodb project adodb | = 5.15 | No fix listed |
| adodb project adodb | = 5.16 | No fix listed |
| adodb project adodb | = 5.16-a | No fix listed |
| adodb project adodb | = 5.17 | No fix listed |
| adodb project adodb | = 5.18 | No fix listed |
| adodb project adodb | = 5.18-a | No fix listed |
| adodb project adodb | = 5.19 | No fix listed |
| adodb project adodb | = 5.20.0 | No fix listed |
| adodb project adodb | = 5.20.1 | No fix listed |
| adodb project adodb | = 5.20.2 | No fix listed |
| adodb project adodb | = 5.20.3 | No fix listed |
| adodb project adodb | = 5.20.4 | No fix listed |
| adodb project adodb | = 5.20.5 | No fix listed |
| adodb project adodb | = 5.20.6 | No fix listed |
| fedoraproject fedora | = 25 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch vendor-advisory
- github.com patch release-notes vendor-advisory
- lists.fedoraproject.org
- GLSA-201701-59 vendor-advisory
- web.archive.org
- [oss-security] 20160907 ADOdb PDO driver: incorrect quoting may allow SQL injection mailing-list patch release-notes
- [oss-security] 20160915 Re: ADOdb PDO driver: incorrect quoting may allow SQL injection mailing-list patch release-notes
- Debian Security Tracker CVE-2016-7405 vendor-advisory
- bugs.debian.org issue-tracking
- github.com
- 92969 third-party-advisory vdb-entry
- FEDORA-2016-c5ec2c17e6 vendor-advisory