A security flaw tracked as CVE-2025-14179 affects specific recent versions of PHP, the programming language that powers many dynamic websites. The impacted versions are PHP 8.2 before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21, and 8.5 before 8.5.6. This flaw impacts sites that use the Firebird database driver via PHP's PDO database interface.
The issue occurs when PHP builds SQL database queries that include a special character called a NUL byte in user-provided input. When a site uses the PDO::quote function to format user input for use in database queries, this processing error can let attackers inject malicious SQL code into otherwise legitimate queries.
If exploited, this could allow unauthorized parties to access, alter, or delete data stored in your site's database, or take other unapproved actions on your website.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
