ADOdb SQL Injection Vulnerability in SQLite3 Driver

A critical SQL injection vulnerability has been identified in ADOdb versions 5.22.9 and prior, specifically within the SQLite3 database driver. The issue arises from improper escaping of query parameters, which may allow an attacker to execute arbitrary SQL statements. This vulnerability is triggered when the affected code calls the metaColumns(), metaForeignKeys(), or metaIndexes() methods with a crafted table name. The vulnerability has been addressed in ADOdb version 5.22.10.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution on the connected SQLite3 database, potentially leading to unauthorized data manipulation or disclosure.

Remediation

Users can upgrade to ADOdb version 5.22.10 to address this vulnerability. For those unable to upgrade, it is advised to only pass controlled data to the metaColumns(), metaForeignKeys(), and metaIndexes() methods' table parameter.