PEAR SQL Injection Vulnerability in Package Version Endpoint

A critical unauthenticated SQL injection vulnerability has been identified in PEAR versions prior to 1.33.0. The issue resides in the '/get/<package>/<version>' endpoint, where remote attackers can execute arbitrary SQL by crafting a specific package version. This vulnerability arises because user input is directly interpolated into SQL queries without proper parameterization, allowing for SQL injection through the version path segment.

Impact

Exploitation of this vulnerability allows for unauthenticated remote SQL injection, enabling attackers to execute arbitrary SQL commands on the database.

Remediation

Users can upgrade to PEAR version 1.33.0 or later to address this vulnerability.