Php · Php · CVE-2025-14179
**Name of the Vulnerable Software and Affected Versions**
PHP versions 8.2.0 through 8.2.30
PHP versions 8.3.0 through 8.3.30
PHP versions 8.4.0 through 8.4.20
PHP versions 8.5.0 through 8.5.5
**Description**
The PDO Firebird driver improperly handles NUL bytes during the preparation of SQL queries. When constructing queries token-by-token, a string token containing a NUL byte is processed using the `strncat()` function, which terminates at the NUL byte. This action drops the closing quote, causing subsequent SQL tokens to be interpreted as part of the string. This behavior enables SQL injection when attacker-controlled values are quoted using the `PDO::quote()` function and embedded in SQL statements.
**Recommendations**
Update PHP version 8.2.x to 8.2.31
Update PHP version 8.3.x to 8.3.31
Update PHP version 8.4.x to 8.4.21
Update PHP version 8.5.x to 8.5.6