CVE-2022-31631

Advisory lineage Upstream: 0 Downstream: 17
Analyzed
Published: 12 Feb 2025, 22:10
Last modified:13 Feb 2025, 16:06

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (cve.org)
EPSS Score
0.6% LOW
1% probability -0.18%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Feb 2025, 22:10
Published
Vulnerability first disclosed
13 Feb 2025, 16:06
Last Modified
Vulnerability information updated

Description

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.60%• Percentile: 70%

Techniques & Countermeasures

  • CWE-74•Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Systems

  • Unknown•PHP

    ≥ 8.0.x, < 8.0.27 | ≥ 8.1.x, < 8.1.15 | ≥ 8.2.x, < 8.2.2

  • Unknown•PHP

    ≥ 8.0.0, < 8.0.27 | ≥ 8.1.0, < 8.1.15 | ≥ 8.2.0, < 8.2.2

References (2)