CVE-2022-31631

Aliases:DEBIAN-CVE-2022-31631CGA-329p-65w3-v34xCGA-x4h3-mrmf-x7c5
Advisory lineage Upstream: 0 Downstream: 17
Analyzed
Published: 12 Feb 2025, 22:10
Last modified:13 Feb 2025, 16:06

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (cve.org)
EPSS Score
2.17% LOW
2% probability +1.39%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Feb 2025, 22:10
Published
Vulnerability first disclosed
13 Feb 2025, 16:06
Last Modified
Vulnerability information updated

Description

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 2.17%• Percentile: 81%

Techniques & Countermeasures

  • CWE-74•Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Systems

  • chainguard•sqlite

    all | < 0

  • wolfi•sqlite

    all | < 0

  • debian•php7.4

    < 7.4.33-1+deb11u3

  • debian•php8.2

    < 8.2.1-1

  • php_group•php

    ≥ 8.0.x, < 8.0.27 | ≥ 8.1.x, < 8.1.15 | ≥ 8.2.x, < 8.2.2

  • php•php

    ≥ 8.0.0, < 8.0.27 | ≥ 8.1.0, < 8.1.15 | ≥ 8.2.0, < 8.2.2

References (5)