CVE-2022-31631

critical · 9.1

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

9.1

CVSS

2.2%

EPSS (exploit prob.)

81st

EPSS percentile

2025-02-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-74

Affected products

Vendor	Product	Affected versions
php	php	>= 8.0.0, < 8.0.27
php	php	>= 8.1.0, < 8.1.15
php	php	>= 8.2.0, < 8.2.2
sqlite	sqlite	>= 3.39.2

Check a specific version with /api/v1/cve/match.

References

https://bugs.php.net/bug.php?id=81740
https://security.netapp.com/advisory/ntap-20230223-0007/
https://bugs.php.net/bug.php?id=81740

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-31631