PDO::quote() may return unquoted string
In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-74 | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
Type: CWE
Description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Version: 3.1
Base score: 9.1
Base severity: CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N