cvedb.io
CVE-2025-14179
CRITICAL · CVSS 9.8
EPSS exploitation probability: 0%
Published 2026-05-10T05:16:09.853 · Last modified 2026-06-30T03:16:43.580

Summary

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

Affected products

php — php

Does this affect you?

Add your gear to cvedb and we'll alert you only when php ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.