CVE-2025-14179: PHP PDO Firebird SQLi Vulnerability

CVE-2025-14179 Overview

CVE-2025-14179 is a SQL injection vulnerability in the PHP PDO Firebird driver. The flaw stems from improper handling of NUL bytes during token-by-token query construction in prepared statements. The driver copies string tokens using strncat(), which terminates at the first NUL byte and drops the closing quote. Subsequent SQL tokens are then interpreted as part of the string literal, enabling SQL injection when attacker-controlled values pass through PDO::quote(). The vulnerability is tracked under [CWE-89] and affects PHP versions 8.2.x, 8.3.x, 8.4.x, and 8.5.x prior to their respective patched releases.

Critical Impact

Attackers can bypass PDO::quote() sanitization and inject arbitrary SQL statements against Firebird databases when applications include NUL bytes in user-supplied input.

Affected Products

• PHP 8.2.x before 8.2.31
• PHP 8.3.x before 8.3.31
• PHP 8.4.x before 8.4.21 and 8.5.x before 8.5.6

Discovery Timeline

• 2026-05-10 - CVE-2025-14179 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-14179

Vulnerability Analysis

The PDO Firebird driver constructs SQL statements by walking through tokens and concatenating them into a destination buffer. The implementation uses strncat() to append quoted string literals to the working query buffer. Because strncat() is a C string function, it stops copying at the first NUL byte it encounters in the source. When an attacker supplies a value containing an embedded NUL byte, the closing quote character placed by PDO::quote() never reaches the destination buffer. The driver then proceeds to append additional tokens, which the database parses as continuation of the unterminated string literal or as new SQL syntax.

Root Cause

The root cause is a mismatch between PHP's binary-safe string handling and the use of C-style NUL-terminated string operations during query assembly. PDO::quote() correctly escapes embedded quotes and applies surrounding delimiters, but the downstream concatenation in the Firebird driver truncates the quoted token. This breaks the trust boundary that PDO::quote() is expected to enforce, leaving applications vulnerable even when they follow recommended escaping practices.

Attack Vector

Exploitation requires the application to embed quoted attacker-controlled input into a SQL statement executed through the PDO Firebird driver. The attacker submits input containing a NUL byte (\\x00) followed by SQL syntax intended to be appended after the broken string token. When the truncated quoted value is concatenated with subsequent SQL fragments, the injected payload executes against the Firebird database. The vulnerability requires user interaction with an affected application but no authentication to PHP itself.

No verified public exploit code is available at this time. See the PHP Security Advisory GHSA-w476-322c-wpvm for upstream technical details.

Detection Methods for CVE-2025-14179

Indicators of Compromise

• Web server access logs containing URL-encoded NUL bytes (%00) in request parameters that reach PDO Firebird query paths.
• Database audit logs showing unexpected SQL statements originating from application accounts, particularly statements that appear truncated or contain unbalanced quotes.
• Application error logs referencing Firebird syntax errors immediately following requests with binary input.

Detection Strategies

• Inspect HTTP request payloads for embedded NUL bytes in fields destined for database queries, including JSON, form parameters, and headers.
• Enable Firebird database query logging and alert on statements containing unusual control characters or unexpected statement chaining.
• Run static analysis on PHP code to identify call sites that pass user input through PDO::quote() to a Firebird DSN, and review them for binary-safety assumptions.

Monitoring Recommendations

• Monitor for PHP processes loading the pdo_firebird extension and inventory applications that depend on it.
• Correlate web application firewall events for NUL byte payloads with downstream database activity from the same session.
• Track installed PHP runtime versions across the environment and flag hosts running unpatched 8.2, 8.3, 8.4, or 8.5 builds.

How to Mitigate CVE-2025-14179

Immediate Actions Required

• Upgrade PHP to 8.2.31, 8.3.31, 8.4.21, or 8.5.6 or later, depending on the deployed branch.
• Audit all application code that uses PDO::quote() with the Firebird driver and add explicit rejection of input containing NUL bytes.
• Restrict database account privileges used by PHP applications so that successful injection does not grant administrative access to Firebird.

Patch Information

The PHP project published fixes in the upstream php-src repository and documented them in the PHP Security Advisory GHSA-w476-322c-wpvm. Apply the vendor patch by upgrading to the fixed minor release on the matching branch.

Workarounds

• Replace PDO::quote() plus string interpolation with parameterized prepared statements using bindValue() or bindParam(), which avoid the vulnerable concatenation path.
• Strip or reject NUL bytes (\\x00) from all user input at the application boundary before it reaches database code.
• If upgrading is not immediately feasible, migrate affected workloads off the PDO Firebird driver to a different database connector until the patched PHP version is deployed.

# Verify the installed PHP version on the host
php -v

# Example input filter to reject NUL bytes before query construction
# (apply in application code, not as a substitute for patching)
if (strpos($input, "\0") !== false) {
    throw new InvalidArgumentException('NUL byte in input');
}