CVE-2025-46337: SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pginsertid() with user-supplied data. This issue has been patched in version 5.22.9.
Other sources
Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pginsertid() with user-supplied data.
Note that the indicated Severity corresponds to a worst-case usage scenario.
Impact PostgreSQL drivers (postgres64, postgres7, postgres8, postgres9).
Patches Vulnerability is fixed in ADOdb 5.22.9 (11107d6d6e5160b62e05dff8a3a2678cf0e3a426).
Workarounds Only pass controlled data to pginsertid() method's $fieldname parameter, or escape it with pgescapeidentifier() first.
References - Issue https://github.com/ADOdb/ADOdb/issues/1070 - Blog post by Marco Nappi
Credits Thanks to Marco Nappi (@mrcnpp) for reporting this vulnerability.
— GitHub
SQL injection in ADOdb PostgreSQL driver pginsertid() method
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/adodb/adodb-phpto a version that resolves this vulnerability.Fixed in 5.22.9 - Upgrade
Upgrade
ubuntu/libphp-adodbto a version that resolves this vulnerability.Fixed in 5.20.3-1ubuntu1+esm2 - Upgrade
Upgrade
ubuntu/libphp-adodbto a version that resolves this vulnerability.Fixed in 5.20.9-1ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/libphp-adodbto a version that resolves this vulnerability.Fixed in 5.20.16-1ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/libphp-adodbto a version that resolves this vulnerability.Fixed in 5.20.19-1ubuntu0.1+esm1 - Upgrade
Upgrade
ubuntu/libphp-adodbto a version that resolves this vulnerability.Fixed in 5.21.4-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/libphp-adodbto a version that resolves this vulnerability.Fixed in 5.22.9-0.1 - Upgrade
Upgrade
ADOdbto a version that resolves this vulnerability.Fixed in 5.22.9 - Compensating control
For PostgreSQL drivers, only pass controlled data to the pg_insert_id() method's $fieldname parameter, or escape it first with pg_escape_identifier().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46337?
The severity of CVE-2025-46337 is classified based on the potential for arbitrary SQL execution due to improper escaping of user-supplied data.
How do I fix CVE-2025-46337?
To fix CVE-2025-46337, upgrade the ADOdb package to version 5.22.9 or later.
Which versions of ADOdb are affected by CVE-2025-46337?
Versions of ADOdb prior to 5.22.9, specifically up to and including 5.22.8, are affected by CVE-2025-46337.
What are the implications of CVE-2025-46337 for a PostgreSQL database?
CVE-2025-46337 allows attackers to execute arbitrary SQL statements on a PostgreSQL database if the vulnerable version of ADOdb is used.
Is CVE-2025-46337 related to any particular database feature?
Yes, CVE-2025-46337 specifically affects the pg_insert_id() function when it processes user input without proper escaping.