CVE-2025-14179

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its PDO extension provides a common database API, and the pdo_firebird driver connects PDO to Firebird and InterBase databases.

A SQL Injection vulnerability (CVE-2025-14179) has been identified in the query preparation of PHP's PDO Firebird driver, which allows an attacker whose input is quoted with PDO::quote() and embedded in an SQL statement to inject SQL by including a NUL byte. PHP tracks this issue as GHSA-w476-322c-wpvm.

Per MITRE CWE-89: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

This issue affects all versions of PHP from 8.0.0 before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/pdo_firebird)
• Affected versions: >=8.0.0 <8.2.31, >=8.3.0 <8.3.31, >=8.4.0 <8.4.21, >=8.5.0 <8.5.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6
  • NES for PHP 8.0.1 (based on PHP 8.0.30)

Vulnerability Info

This High-severity vulnerability is found in the pdo_firebird driver of all PHP versions from 8.0.0 before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6, including the End-of-Life PHP 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 7.4 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/RE:M/U:Amber).

Starting with PHP 8.0, the driver rewrites each statement before preparing it: preprocess() walks the SQL token by token and appends each token to a new buffer. String literals are copied with strncat(), which stops at the first NUL byte. In PHP 8.0.30 the code reads:

        case ttWhite:
        case ttComment:
        case ttString:
        case ttOther:
            strncat(sql_out, start, p - start);
            break;

PDO::quote() returns a quoted string that can contain a NUL byte. When such a literal is copied, everything after the NUL byte is dropped, including the closing quote, so the SQL that follows is read as part of the string and the next quoted value can end it and add SQL of its own. The advisory shows a SELECT whose WHERE clause is rewritten this way, and lists SELECT, INSERT, UPDATE, DELETE, MERGE, WITH and EXECUTE statements as affected.

Exposure requires an application that uses pdo_firebird and builds SQL by embedding PDO::quote() output for attacker-controlled values. Queries that pass values as bound parameters of prepared statements, and applications that use other PDO drivers, are not affected. PHP 7.4 and earlier do not use this preprocessing step.

The fix copies tokens with memcpy() and an explicit length, passes that length to isc_dsql_prepare(), and rewrites the quoting routine to walk the whole string instead of stopping at a NUL byte. In PHP 8.2.31 the token copy reads:

        case ttWhite:
        case ttComment:
        case ttString:
        case ttOther:
            memcpy(sql_out_p, start, p - start);
            sql_out_p += p - start;
            break;

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, pass values to Firebird queries as bound parameters of prepared statements instead of embedding PDO::quote() output in SQL text, or reject input that contains NUL bytes.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Aleksey Solovev, Positive Technologies (finder)
• Nikita Sveshnikov, Positive Technologies (finder)
• Saki Takamachi (remediation)