A vulnerability has been identified in the ADOdb library, used in many PHP projects for database access abstraction and with approximately 3 million installations from the Packagist repository (CVE-2025-46337). This vulnerability enables the execution of custom SQL queries. It has been assigned a critical threat level (10 out of 10). The vulnerability has been addressed in ADOdb version 5.22.9.
The vulnerability occurs when using ADOdb with the PostgreSQL database in applications that call the pg_insert_id() method and transmit unvalidated external data through the $fieldname parameter. The issue is caused by a bug in the ADOdb driver for PostgreSQL, related to the lack of proper escaping of special characters in the $tablename and $fieldname parameters before they are used in the pg_insert_id() function to form the sequence name. $result=pg_query($this->_connectionID, 'SELECT last_value FROM ' . $tablename . '_' . $fieldname . '_seq');
Izvor: opennet.ru
