ADOdb PostgreSQL Driver SQL Injection Vulnerability in pg_insert_id() Method

A SQL injection vulnerability has been identified in the ADOdb library for PHP, specifically in the PostgreSQL database driver. This issue arises from improper escaping of query parameters, which may allow an attacker to execute arbitrary SQL statements. The vulnerability is present in ADOdb versions through 5.22.8 and is triggered when the pg_insert_id() function is called with user-supplied data.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can execute arbitrary SQL commands on the database.

Reproduction

To reproduce this vulnerability, use ADOdb versions through 5.22.8 and connect to a PostgreSQL database. Call the pg_insert_id() method with unescaped user-supplied data, which will result in the execution of arbitrary SQL statements.

Remediation

Upgrade to ADOdb version 5.22.9 or later, where this vulnerability has been fixed.