USN-7530-1: ADOdb vulnerability

Q: Which systems should be prioritized for triage?

Prioritize Ubuntu systems that use the libphp-adodb package, especially where an application is remotely reachable and processes SQL input influenced by untrusted users.

Q: What would an attacker need to exploit this issue?

The issue is described as remotely exploitable. An attacker would need a way to supply SQL input to the affected ADOdb usage, allowing arbitrary SQL commands to be executed.

Published May 29, 2025

Updated

It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.

Affected Software

4 affected componentsFixes available

All of the following

ubuntu/libphp-adodb<5.22.8-0.1ubuntu0.1

5.22.8-0.1ubuntu0.1

Ubuntu Ubuntu=25.04

All of the following

ubuntu/libphp-adodb<5.22.7-0.1ubuntu0.1

5.22.7-0.1ubuntu0.1

Ubuntu Ubuntu=24.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libphp-adodb to a version that resolves this vulnerability.
Fixed in 5.22.8-0.1ubuntu0.1
Upgrade
Upgrade ubuntu/libphp-adodb to a version that resolves this vulnerability.
Fixed in 5.22.7-0.1ubuntu0.1

Event History

May 29, 2025

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-46337

Frequently Asked Questions

Which systems should be prioritized for triage?

Prioritize Ubuntu systems that use the libphp-adodb package, especially where an application is remotely reachable and processes SQL input influenced by untrusted users.

What would an attacker need to exploit this issue?

The issue is described as remotely exploitable. An attacker would need a way to supply SQL input to the affected ADOdb usage, allowing arbitrary SQL commands to be executed.

USN-7530-1: ADOdb vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems should be prioritized for triage?

What would an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for triage?

What would an attacker need to exploit this issue?