Symfony PdoAdapter SQL Injection Vulnerability in Cache Component

A SQL injection vulnerability has been identified in the PdoAdapter of Symfony's Cache component, affecting versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. The issue arises in the clear() method, where the $prefix parameter is used to construct a DELETE SQL statement without proper binding or escaping. This allows an attacker to manipulate the $prefix value, break out of the LIKE literal, and alter the query's behavior or the scope of deletion. Although this method is not typically exposed to untrusted input, its design should safely accommodate any prefix string, making the vulnerability a flaw in the adapter's implementation.

Impact

Exploitation of this vulnerability allows for arbitrary SQL injection, enabling attackers to manipulate database queries and potentially access or modify sensitive data.

Reproduction

The vulnerability can be reproduced by calling the clear() method on a PdoAdapter instance with a crafted prefix that includes characters such as quotes, percent signs, or null bytes. This will disrupt the SQL query's LIKE literal and inject malicious SQL, altering the query's intended function or deletion scope.

Remediation

Users can update to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 to address this vulnerability.