CVE-2025-14179

A flaw was found in PHP. The PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This flaw allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

This issue can be exploited in applications using the PDO Firebird driver. The application must construct dynamic queries using PDO::quote() and the query structure must contain subsequent string boundaries or parameters. This allows an attacker to inject a malicious payload, resulting in the execution of arbitrary database commands. Additionally, the use of PDO::quote() for manual concatenation is heavily discouraged and considered a legacy anti-pattern. Modern PHP applications use native prepared statements ($stmt->execute()) that are not vulnerable to this issue, limiting its exposure. Due to these reasons, this vulnerability has been rated with an important severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, do not use 'PDO::quote()' for manual query concatenation. Refactor the application to use native parameterized prepared statements. Additionally, implement an input validation mechanism to reject any user-supplied data containing control characters, specifically the NUL byte (\x00).