A security flaw has been identified in specific versions of the PHP programming language that powers many websites. The affected versions are PHP 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
The bug exists in the part of PHP used to connect to Firebird databases. When this tool processes data that includes a special NUL (null) character, it can break the structure of database queries. This occurs because the tool stops reading the data at the NUL byte, which drops the closing quote around the value and causes subsequent parts of the query to be interpreted as part of the user-provided data.
When attacker-controlled values are quoted using the PDO::quote() function and embedded into SQL statements, this flaw can be exploited to carry out SQL injection attacks.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
