A security flaw exists in specific older versions of PHP, the software used to run many dynamic websites, when the PDO Firebird database connection tool is in use. The affected versions are PHP 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6. The bug occurs when building database queries that include invisible NUL characters. When a quoted value containing a NUL character is processed, the system stops reading the input at that character, which drops the closing quote for the value. This causes all subsequent parts of the SQL command to be treated as part of the user-provided string instead of separate database instructions. If an attacker can send input that is formatted for queries via the PDO::quote() function and embedded into SQL statements, this flaw enables SQL injection. This could let unauthorized parties run unapproved database commands, potentially accessing, modifying, or deleting your website's stored data such as user information, order records, or site content.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
