blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-7405

CRITICAL 9.8 CVSS 3.0
Published
October 3, 2016
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-89
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.

References

  • www.openwall.com http://www.openwall.com/lists/oss-security/2016/09/07/8 Patch, Release Notes
  • www.openwall.com http://www.openwall.com/lists/oss-security/2016/09/15/1 Patch, Release Notes
  • www.securityfocus.com http://www.securityfocus.com/bid/92969 Third Party Advisory
  • github.com https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md Patch, Release Notes, Vendor Advisory
  • github.com https://github.com/ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8 Patch, Vendor Advisory
  • github.com https://github.com/ADOdb/ADOdb/issues/226 Patch
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y/
  • security.gentoo.org https://security.gentoo.org/glsa/201701-59
  • nvd.nist.gov Official NVD record