PT-2025-31792 · Sqlite3+3 · Sqlite3+3

Mrcnpp · CVE-2025-54119 · Published 2025-08-03 · Updated 2025-10-20

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ADOdb version 5.22.10

Description Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when connecting to a sqlite3 database and calling the metaColumns(), metaForeignKeys(), or metaIndexes() methods with a crafted table name. The vulnerability exists in the SQLite3 driver.

Recommendations Only pass controlled data to the $table parameter of the metaColumns(), metaForeignKeys(), and metaIndexes() methods.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-10815

CVE-2025-54119

DLA-4340-1

GHSA-VF2R-CXG9-P7RF

Affected Products

Adodb

Debian

Red Os

Sqlite3

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54119.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-54119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-54119 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10815 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54119 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54119 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54119 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf2r-cxg9-p7rf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54119 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54119 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4340-1 · Vendor Advisory
• https://github.com/ADOdb/ADOdb/issues/1083 · Note
• https://github.com/ADOdb/ADOdb/security/advisories/GHSA-vf2r-cxg9-p7rf · Note
• https://github.com/ADOdb/ADOdb/commit/5b8bd52cdcffefb4ecded1b399c98cfa516afe03 · Note