Executive brief
A security vulnerability exists in the PHP database driver used for Firebird databases. This flaw allows attackers to bypass security protections when a website processes specially crafted input, potentially leading to unauthorized access or theft of sensitive data stored in the database. Organizations using PHP with Firebird databases should update their PHP installation to the latest patched version immediately.
Technical details
A SQL injection vulnerability exists in the PHP PDO Firebird driver (pdo_firebird) due to improper handling of NUL bytes (\0) in quoted strings. During token-by-token query construction in firebird_driver.c, the driver uses strncat() to copy string tokens; because strncat() terminates at the first NUL byte, it may fail to append the closing quote of a string literal. This causes subsequent SQL tokens to be incorrectly interpreted as part of the string or vice versa, allowing an attacker to break out of the quoted context. The vulnerability can be exploited if attacker-controlled values containing NUL bytes are processed via PDO::quote() and then embedded into SQL statements. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.
Affected products
- PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Enterprise Linux 10
Timeline
- 2026-05-07: advisory: PHP Group published security advisory GHSA-w476-322c-wpvm
- 2026-05-10: disclosed: CVE-2025-14179 published