PEAR SQL Injection Vulnerability in User Role Filter

A SQL injection vulnerability has been identified in PEAR versions prior to 1.33.0. The issue arises in the 'user::maintains()' function when role filters are supplied as an array and directly inserted into an 'IN (...)' clause without proper parameter binding. This flaw allows attackers to manipulate role strings and inject malicious SQL into the query.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users can upgrade to PEAR version 1.33.0 or later to address this vulnerability.