CVE-2022-31631 – SQLite PDO Quote Function SQL Injection Vulnerability in PHP
The following table lists the changes that have been made to the CVE-2022-31631 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Feb. 12, 2025
Action Type Old Value New Value Added Reference https://security.netapp.com/advisory/ntap-20230223-0007/ -
New CVE Received by [email protected]
Feb. 12, 2025
Action Type Old Value New Value Added Description In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Added CWE CWE-74 Added Reference https://bugs.php.net/bug.php?id=81740