Loading HuntDB...

CVE-2025-46337

CRITICAL
Published 2025-05-01T17:20:10.658Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-46337. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
10.0
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.001
probability
of exploitation in the wild

There is a 0.1% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.215
Higher than 21.5% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
HIGH
Availability
LOW

Description

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.

Available Exploits

No exploits available for this CVE.

Related News

Critical SQL Injection Vulnerability Found in ADOdb PHP Library – CVE-2025-46337 (CVSS 10.0)

A critical security flaw has been disclosed in ADOdb, the widely-used PHP database abstraction library with over 2.8 The post Critical SQL Injection Vulnerability Found in ADOdb PHP Library – CVE-2025-46337 (CVSS 10.0) appeared first on Daily CyberSecurity.

SecurityOnline.info 2025-05-05 00:43

Affected Products

Affected Versions:

EU Vulnerability Database

Monitored by ENISA for EU cybersecurity

EU Coordination

EU Coordinated

Exploitation Status

No Known Exploitation

ENISA Analysis

SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

Affected Products (ENISA)

adodb
adodb

ENISA Scoring

CVSS Score (3.1)

10.0
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

EPSS Score

0.070
probability

Data provided by ENISA EU Vulnerability Database. Last updated: May 5, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed CRITICAL

SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

GHSA-8x27-jwjr-8545

Advisory Details

Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. Note that the indicated Severity corresponds to a worst-case usage scenario. ### Impact PostgreSQL drivers (postgres64, postgres7, postgres8, postgres9). ### Patches Vulnerability is fixed in ADOdb 5.22.9 (11107d6d6e5160b62e05dff8a3a2678cf0e3a426). ### Workarounds Only pass controlled data to pg_insert_id() method's $fieldname parameter, or escape it with pg_escape_identifier() first. ### References - Issue https://github.com/ADOdb/ADOdb/issues/1070 - [Blog post](https://xaliom.blogspot.com/2025/05/from-sast-to-cve-2025-46337.html) by Marco Nappi ### Credits Thanks to Marco Nappi (@mrcnpp) for reporting this vulnerability.

Affected Packages

Packagist adodb/adodb-php
ECOSYSTEM: ≥0 <5.22.9

CVSS Scoring

CVSS Score

9.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Advisory provided by GitHub Security Advisory Database. Published: May 1, 2025, Modified: May 26, 2025

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

1 post
Reddit 5 days, 18 hours ago
michaelpaoli

Debian 13.1 (and 12.12) 2025-09-06 "Just" a "minor" point release. But for those that have been waiting to upgrade to Debian 13, perhaps that time now draws nearer? [\[SUA 273-1\] Upcoming Debian 13 Update (13.1)](https://lists.debian.org/debian-stable-announce/2025/09/msg00000.html) [\[SUA 274-1\] Upcoming Debian 12 Update (12.12)](https://lists.debian.org/debian-stable-announce/2025/09/msg00001.html) 13.1: >\[SUA 273-1\] Upcoming Debian 13 Update (13.1) …

Also mentions: CVE-2025-7039 CVE-2025-40927 CVE-2025-9185 CVE-2025-9181 CVE-2025-47806 CVE-2025-47219 CVE-2025-47807 CVE-2025-47808 CVE-2025-53859 CVE-2025-50952 CVE-2025-54798 CVE-2025-54874 CVE-2025-54350 CVE-2025-54349 CVE-2025-27613 CVE-2025-27614 CVE-2025-20260 CVE-2025-23048 CVE-2025-46835 CVE-2025-49812 CVE-2025-49630 CVE-2025-53019 CVE-2025-53101 CVE-2025-53020 CVE-2025-8058 CVE-2024-42516 CVE-2024-43394 CVE-2024-43204 CVE-2024-47252 CVE-2025-6965 CVE-2025-7394 CVE-2025-7783 CVE-2025-53015 CVE-2025-53014 CVE-2025-48385 CVE-2025-48384 CVE-2024-25178 CVE-2024-25177 CVE-2024-25176 CVE-2025-4748 CVE-2024-6174 CVE-2024-11584 CVE-2025-6170 CVE-2025-49794 CVE-2025-49796 CVE-2025-6021 CVE-2025-5916 CVE-2025-5915 CVE-2025-5914 CVE-2025-5917 CVE-2025-49133 CVE-2025-48387 CVE-2025-27553 CVE-2025-27773 CVE-2025-48734 CVE-2025-46712 CVE-2025-46393 CVE-2025-46398 CVE-2025-46397 CVE-2025-47203 CVE-2023-52970 CVE-2023-26819 CVE-2025-40908 CVE-2025-40909 CVE-2025-4373 CVE-2023-53154 CVE-2025-2784 CVE-2025-48060 CVE-2025-47273 CVE-2025-4802 CVE-2025-46399 CVE-2025-46400 CVE-2025-32050 CVE-2025-46421 CVE-2025-46420 CVE-2025-43965 CVE-2025-43964 CVE-2025-43963 CVE-2025-43962 CVE-2025-43961 CVE-2025-3818 CVE-2025-32906 CVE-2025-32912 CVE-2025-32911 CVE-2025-30722 CVE-2025-30693 CVE-2025-3576 CVE-2025-32910 CVE-2025-32909 CVE-2025-32913 CVE-2025-32053 CVE-2025-32052 CVE-2025-32051 CVE-2024-12905 CVE-2025-30472 CVE-2024-6866 CVE-2024-6844 CVE-2024-6839 CVE-2024-8176 CVE-2023-52971 CVE-2023-52969 CVE-2025-27516 CVE-2025-27221 CVE-2022-37660 CVE-2024-56161 CVE-2025-20128 CVE-2025-23016 CVE-2024-34703 CVE-2024-34702 CVE-2024-45236 CVE-2024-45234 CVE-2024-45235 CVE-2024-45238 CVE-2024-45237 CVE-2024-45239 CVE-2024-0962 CVE-2024-10525 CVE-2024-31031 CVE-2024-38875 CVE-2024-57822 CVE-2024-57823 CVE-2024-3935 CVE-2024-42005 CVE-2024-39330 CVE-2024-39329 CVE-2024-39917 CVE-2024-39312 CVE-2024-39614 CVE-2024-52532 CVE-2024-52530 CVE-2024-52531 CVE-2024-33899 CVE-2024-50602 CVE-2024-50624 CVE-2024-50383 CVE-2024-50612 CVE-2024-5569 CVE-2024-49768 CVE-2024-49769 CVE-2024-1681 CVE-2024-41991 CVE-2024-41990 CVE-2024-41989 CVE-2024-8376 CVE-2023-36053 CVE-2023-31484 CVE-2023-28755 CVE-2023-28366 CVE-2023-42822 CVE-2023-52425 CVE-2023-40184 CVE-2022-33065 CVE-2021-46312 CVE-2021-46310 CVE-2021-25743 CVE-2019-25211
70
8
86.0

References

Published: 2025-05-01T17:20:10.658Z
Last Modified: 2025-05-26T18:03:45.346Z
Copied to clipboard!