Critical severity · published Oct 3, 2016
CVE-2016-7405
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to…
9.8
CVSS
3%
EPSS
No
On KEV
Description
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Adodb · Adodb Project
5.00; 5.01; 5.02; 5.02; 5.03; 5.04; +28 more · source: NVD
FE
Fedora · Fedoraproject
25 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7405
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7405
Patch
http://www.openwall.com/lists/oss-security/2016/09/07/8
Patch
http://www.openwall.com/lists/oss-security/2016/09/15/1
Third Party Advisory
http://www.securityfocus.com/bid/92969
Patch
https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md
Patch
https://github.com/ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8
Patch
https://github.com/ADOdb/ADOdb/issues/226
More from Adodb
9.1
CVE-2021-3850
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21
6.1
CVE-2016-4855
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors