Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumns(), metaForeignKeys() or metaIndexes() methods with a crafted table name. Note that the indicated Severity corresponds to a worst-case usage scenario, e.g. allowing user-supplied data to be sent as-is to the above-mentioned methods. Impact SQLite3 driver. Patches Vulnerability is fixed in ADOdb 5.22.10 (https://github.com/ADOdb/ADOdb/commit/5b8bd52cdcffefb4ecded1b399c98cfa516afe03). Workarounds Only pass controlled data to metaColumns(), metaForeignKeys() and metaIndexes() method's $table parameter. Credits Thanks to Marco Nappi (@mrcnpp) for reporting this vulnerability.
Recommended action: Upgrade to 5.22.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pginsertid() with user-supplied data. Note that the indicated Severity corresponds to a worst-case usage scenario. Impact PostgreSQL drivers (postgres64, postgres7, postgres8, postgres9). Patches Vulnerability is fixed in ADOdb 5.22.9 (11107d6d6e5160b62e05dff8a3a2678cf0e3a426). Workarounds Only pass controlled data to pginsertid() method's $fieldname parameter, or escape it with pgescapeidentifier() first. References - Issue https://github.com/ADOdb/ADOdb/issues/1070 - Blog post by Marco Nappi Credits Thanks to Marco Nappi (@mrcnpp) for reporting this vulnerability.
Recommended action: Upgrade to 5.22.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ADOdb Library for PHP prior to version 5.20.11 is prone to SQL Injection vulnerability in multiple drivers.
Recommended action: Upgrade to 5.20.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 5.20.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Recommended action: Upgrade to 5.20.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes. Depending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server's IP address, etc. Patches The vulnerability is fixed in ADOdb versions 5.20.21 (952de6c4273d9b1e91c2b838044f8c2111150c29) and 5.21.4 or later (b4d5ce70034c5aac3a1d51d317d93c037a0938d2). The simplest patch is to delete line 29 in drivers/adodb-postgres64.inc.php: Workarounds Ensure the parameters passed to ADOConnection::connect() or related functions (nConnect(), pConnect()) are not surrounded by single quotes. Credits Thanks to Emmet Leahy (@meme-lord) of Sorcery Ltd for reporting this vulnerability, and to the huntr team for their support. References - Original issue report https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c/ - ADOdb reference issue #793 For more information If you have any questions or…
Recommended action: Upgrade to 5.21.4 or 5.20.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.