A security flaw has been identified in specific versions of PHP, the software that powers many dynamic websites. The issue affects the component PHP uses to connect to Firebird databases, called the PDO Firebird driver.
When this component builds SQL database queries, it fails to handle a special character type (called a NUL byte) correctly. This error causes the closing quotation mark for a string in the query to be dropped, so the rest of the query is treated as part of that string. If an attacker can control the value of that string, they can insert malicious SQL commands to run on your database.
The vulnerable PHP versions are 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6. If your site uses PHP to connect to a Firebird database and relies on the built-in PDO quote function to process user-provided data (like form inputs or search terms) in database queries, this flaw could let bad actors access, modify, or delete the data stored on your site.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
