CVE-2022-31631: PDO::quote() may return unquoted string
Published Jan 5, 2023
·Updated
Fixed bug (PDO::quote() may return unquoted string). (CVE-2022-31631)
Other sources
In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, 8.2. before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.
— NVD
Affected Software
7 affected componentsFixes available
PHP PHP<8.0.27
8.0.27
debian/php7.4
7.4.33-1+deb11u57.4.33-1+deb11u8
debian/php8.2
8.2.26-1~deb12u18.2.28-1~deb12u1
All of the following
Any of the following
PHP PHP>=8.0.0<8.0.27
PHP PHP>=8.1.0<8.1.15
PHP PHP>=8.2.0<8.2.2
SQLite SQLite>=3.39.2
Event History
Jan 5, 2023
CVE Published
via PHP·12:00 AM
Feb 12, 2025
CVE Published
via MITRE·10:10 PM
Data Sourced
via MITRE·10:10 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
Affected Software
Feb 24, 2025
Data Sourced
via Ubuntu·05:22 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2022-31631?
CVE-2022-31631 is a vulnerability in PHP which allows PDO::quote() to return an unquoted string.
2
How does CVE-2022-31631 affect PHP?
CVE-2022-31631 affects PHP versions up to and including 8.0.27.
3
Is there a fix available for CVE-2022-31631?
Yes, the vulnerability has been fixed in PHP version 8.0.27.
4
What is PDO::quote()?
PDO::quote() is a PHP function used to quote a string for use in a query.
5
How can I find more information about CVE-2022-31631?
You can find more information about CVE-2022-31631 in the PHP ChangeLog for version 8.0.27.