A security flaw has been identified in specific older versions of PHP, the core software that runs most dynamic websites, that affects sites using the PDO Firebird tool to connect to Firebird databases.
The issue occurs when the tool builds database queries from user-submitted input, such as form entries. If the input contains a hidden NUL character, the tool cuts off the input early when adding quote marks around it. This allows attackers to insert unauthorized database commands into the input, a common attack type known as SQL injection.
If this flaw is exploited, an attacker could access, alter, or delete data stored in your Firebird database, or take control of site features that rely on that database. The impacted PHP versions are 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
