CVE-2025-54119: ADOdb PHP Library SQL Injection Vulnerability

CVE-2025-54119 Overview

CVE-2025-54119 is a SQL Injection vulnerability affecting ADOdb, a widely-used PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping of a query parameter allows attackers to execute arbitrary SQL statements when applications using ADOdb connect to a sqlite3 database and call the metaColumns(), metaForeignKeys(), or metaIndexes() methods with a crafted table name.

Critical Impact

Attackers can execute arbitrary SQL statements on sqlite3 databases through crafted table name parameters, potentially leading to complete database compromise, data exfiltration, and unauthorized data manipulation.

Affected Products

• ADOdb versions 5.22.9 and below
• Applications using ADOdb with sqlite3 database connections
• Systems utilizing the vulnerable metaColumns(), metaForeignKeys(), or metaIndexes() methods

Discovery Timeline

• 2025-08-05 - CVE CVE-2025-54119 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-54119

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in the ADOdb sqlite3 driver, specifically in the implementation of metadata retrieval methods. The vulnerability arises from direct string interpolation of user-controllable table name parameters into PRAGMA SQL statements without proper parameterization or escaping.

When an application passes unvalidated input to the metaColumns(), metaForeignKeys(), or metaIndexes() methods, an attacker can craft a malicious table name that breaks out of the intended SQL context and injects arbitrary SQL statements. This is particularly dangerous because these methods are often called with user-supplied data during database schema introspection operations.

The vulnerability affects the network attack vector and requires no authentication or user interaction to exploit, making it highly accessible to remote attackers. Successful exploitation can result in complete confidentiality and integrity compromise of the underlying database.

Root Cause

The root cause is insufficient input validation and improper escaping in the sqlite3 driver's metadata methods. The vulnerable code directly interpolates the $table parameter into SQL PRAGMA statements using string concatenation instead of using parameterized queries. This allows specially crafted table names containing SQL syntax to be interpreted as executable SQL code.

Attack Vector

The attack exploits network-accessible applications that use ADOdb with sqlite3 databases. An attacker can inject malicious SQL code by providing a specially crafted table name to any of the three vulnerable methods. The attack requires:

1. An application using ADOdb version 5.22.9 or earlier
2. A sqlite3 database connection
3. Application code that passes attacker-controllable data to metaColumns(), metaForeignKeys(), or metaIndexes()

The vulnerability enables attackers to bypass intended SQL boundaries and execute arbitrary database commands, potentially affecting other system components through changed scope.

// Vulnerable code pattern (before patch)
// Source: https://github.com/ADOdb/ADOdb/commit/5b8bd52cdcffefb4ecded1b399c98cfa516afe03
 		if ($this->fetchMode !== false) {
 			$savem = $this->SetFetchMode(false);
 		}
-		$rs = $this->Execute("PRAGMA table_info('$table')");
+
+		$rs = $this->execute("PRAGMA table_info(?)", array($table));
+
 		if (isset($savem)) {
 			$this->SetFetchMode($savem);
 		}

The patch replaces direct string interpolation with parameterized queries using placeholders, ensuring that table names are properly escaped and cannot break out of the SQL context.

Detection Methods for CVE-2025-54119

Indicators of Compromise

• Unusual or malformed table name parameters in application logs containing SQL syntax characters such as single quotes, parentheses, or SQL keywords
• Error messages from sqlite3 indicating SQL syntax errors in PRAGMA statements
• Database audit logs showing unexpected SQL statements executed during metadata operations
• Application exceptions related to metaColumns(), metaForeignKeys(), or metaIndexes() method calls

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns in request parameters that may be passed to database metadata functions
• Monitor application logs for calls to the three vulnerable ADOdb methods with suspicious input patterns
• Conduct static code analysis to identify instances where user input flows to metaColumns(), metaForeignKeys(), or metaIndexes() without validation
• Deploy runtime application self-protection (RASP) to detect SQL injection attempts at the application layer

Monitoring Recommendations

• Enable detailed sqlite3 query logging to capture all SQL statements executed against the database
• Configure alerting for SQL syntax errors occurring within PRAGMA statement contexts
• Implement database activity monitoring to detect anomalous query patterns
• Review access logs for requests containing encoded or obfuscated SQL injection payloads

How to Mitigate CVE-2025-54119

Immediate Actions Required

• Update ADOdb to version 5.22.10 or later immediately
• Audit all application code that calls metaColumns(), metaForeignKeys(), or metaIndexes() methods to ensure only controlled data is passed
• Implement input validation on any user-supplied data that may be used as table names
• Consider temporarily disabling functionality that relies on the vulnerable methods until patching is complete

Patch Information

ADOdb has released version 5.22.10 which addresses this vulnerability by replacing direct string interpolation with parameterized queries. The fix ensures that table name parameters are properly escaped before being included in PRAGMA statements.

The security patch is available through:

• GitHub Commit
• GitHub Security Advisory
• Debian LTS Announcement

For more details on the vulnerability, see GitHub Issue #1083.

Workarounds

• Only pass controlled, validated data to the metaColumns(), metaForeignKeys(), and metaIndexes() method's $table parameter
• Implement strict allowlist validation for table names before passing them to metadata methods
• Use prepared statements or parameterized queries in custom wrapper functions that call the affected methods
• Apply input sanitization to strip or escape SQL metacharacters from table name inputs

# Verify ADOdb version and update
# Check current version in your composer.json or package configuration
grep -r "adodb" composer.lock

# Update via Composer to patched version
composer require adodb/adodb-php:^5.22.10

# Verify the update
composer show adodb/adodb-php | grep version