PEAR SQL Injection Vulnerability in Bug Subscription Deletion Prior to Version 1.33.0

A SQL injection vulnerability has been identified in PEAR, a framework for reusable PHP components, prior to version 1.33.0. The issue arises in the bug subscription deletion process, where weak email validation allows attackers to inject SQL through a crafted email value. The vulnerability exists because the email validation regex is unanchored, permitting the inclusion of valid-looking email substrings that can disrupt the SQL query execution.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to potentially access, modify, or delete database information.

Remediation

Users can upgrade to PEAR version 1.33.0 or later to address this vulnerability.