A vulnerability (CVE-2025-46337) has been discovered in the ADOdb library, which is used in many PHP projects for database access abstraction and has around 3 million installations from the Packagist repository, allowing for SQL query injection. This issue has been assigned a critical severity level (10 out of 10). The vulnerability has been fixed in the ADOdb release 5.22.9.
The vulnerability occurs when using ADOdb with PostgreSQL databases in applications that call the pg_insert_id() method and pass unvalidated external data through the $fieldname parameter. The issue is caused by an error in the ADOdb driver for PostgreSQL, related to the lack of proper escaping of special characters in the $tablename and $fieldname parameters before they are used in the pg_insert_id() function to construct the sequence name. $result=pg_query($this->_connectionID, 'SELECT last_value FROM ' . $tablename . '_' . $fieldname . '_seq');
Source: opennet.ru
