PT-2025-18680 · Adodb+3 · Adodb+3

Xaliom · Published 2025-05-01 · Updated 2025-09-03 · CVE-2025-46337

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ADOdb versions prior to 5.22.9

Description The issue is related to the improper escaping of a query parameter, which may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and invokes the pg insert id() function with user-supplied data.

Recommendations For versions prior to 5.22.9, update to version 5.22.9 to resolve the issue. As a temporary workaround, consider restricting the use of the pg insert id() function with user-supplied data until the patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-06864

CVE-2025-46337

DLA-4177-1

GHSA-8X27-JWJR-8545

MGASA-2025-0179

USN-7530-1

Affected Products

Adodb

Debian

Red Os

Ubuntu

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46337.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-46337 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0179.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-46337 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8x27-jwjr-8545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46337 · Security Note
• https://ubuntu.com/security/CVE-2025-46337 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7530-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0179 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46337 · Security Note
• https://osv.dev/vulnerability/USN-7530-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4177-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-46337 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06864 · Security Note