9.8crit
CVE-2016-7405
ADOdb Library SQL Injection
Also known as GHSA-3fj4-q72x-x2g9
Published 10 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.0%
percentile 87%
Public exploits
0
none known
Summary
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Exploit prediction (EPSS)
2.98% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | adodb/adodb-php | >=5.0, <5.20.7 | 5.20.7 |
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUI · vendor-advisory, x_refsource_FEDORA, x_transferred
- openwall.com /lists/oss-security/2016/09/07/8 · mailing-list, x_refsource_MLIST, x_transferred
- securityfocus.com /bid/92969 · vdb-entry, x_refsource_BID, x_transferred
- github.com /ADOdb/ADOdb/issues/226 · x_refsource_CONFIRM, x_transferred
- security.gentoo.org /glsa/201701-59 · vendor-advisory, x_refsource_GENTOO, x_transferred
- openwall.com /lists/oss-security/2016/09/15/1 · mailing-list, x_refsource_MLIST, x_transferred
- github.com /ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md · x_refsource_CONFIRM, x_transferred
- github.com /ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-7405 · advisory
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVI · web
- web.archive.org /web/20210123170727/http://www.securityfocus.com/bid/92969 · web
Sources
- CVE List: CVE-2016-7405
- GitHub Advisory: GHSA-3fj4-q72x-x2g9
- NVD: CVE-2016-7405
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.