A security flaw has been identified in specific older versions of PHP, the software that powers most websites. The issue only impacts sites that use the PDO Firebird database driver to connect to a Firebird database, and affects PHP 8.2 versions older than 8.2.31, 8.3 versions older than 8.3.31, 8.4 versions older than 8.4.21, and 8.5 versions older than 8.5.6.
The flaw occurs when the system builds SQL database queries that include user-submitted data, such as information entered into web forms or passed via website links. When processing this data, the system fails to handle special NUL bytes correctly, which can allow attackers to inject unauthorized SQL commands into your database queries. This type of vulnerability, called SQL injection, could let malicious actors view, edit, or delete data stored in your website's database, or gain access to restricted areas of your site without permission.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
