CVE-2022-31631 PDO::quote() may return unquoted string
Attackers can exploit improper quoting in PDO::quote() for SQLite to perform SQL injection, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31631?
CVE-2022-31631 is a critical SQL injection vulnerability in Php Php, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.
Weakness: CWE-74
Which versions are affected by CVE-2022-31631?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.0.0 | 8.0.27, 8.1.15, 8.2.2 |
php Bitnami | From 8.0.0 | 8.0.27, 8.1.15, 8.2.2 |
php-min Bitnami | From 8.0.0 | 8.0.27, 8.1.15, 8.2.2 |
Linux distribution packages (29)
php7 SUSE:Enterprise Storage 6 | All versions | 7.2.34-150000.4.106.1 |
php7 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 7.2.34-150000.4.106.1 |
apache2-mod_php7 SUSE:Linux Enterprise Module for Legacy 15 SP4 | All versions | 7.4.33-150400.4.16.1 |
php7 SUSE:Linux Enterprise Module for Legacy 15 SP4 | All versions | 7.4.33-150400.4.16.1 |
php7-fastcgi SUSE:Linux Enterprise Module for Legacy 15 SP4 | All versions | 7.4.33-150400.4.16.1 |
php7-fpm SUSE:Linux Enterprise Module for Legacy 15 SP4 | All versions | 7.4.33-150400.4.16.1 |
php7-embed SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 7.4.33-150400.4.16.1 |
apache2-mod_php8 SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 8.0.27-150400.4.23.1 |
php8 SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 8.0.27-150400.4.23.1 |
php8-embed SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 8.0.27-150400.4.23.1 |
php8-fastcgi SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 8.0.27-150400.4.23.1 |
php8-fpm SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 8.0.27-150400.4.23.1 |
php8-test SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 8.0.27-150400.4.23.1 |
php7 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 7.2.34-150000.4.106.1 |
php7 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 7.2.34-150000.4.106.1 |
apache2-mod_php7 openSUSE:Leap 15.4 | All versions | 7.4.33-150400.4.16.1 |
apache2-mod_php8 openSUSE:Leap 15.4 | All versions | 8.0.27-150400.4.23.1 |
php7 openSUSE:Leap 15.4 | All versions | 7.2.34-150000.4.106.1 |
php7 openSUSE:Leap 15.4 | All versions | 7.4.33-150400.4.16.1 |
php7-embed openSUSE:Leap 15.4 | All versions | 7.4.33-150400.4.16.1 |
php7-fastcgi openSUSE:Leap 15.4 | All versions | 7.4.33-150400.4.16.1 |
php7-fpm openSUSE:Leap 15.4 | All versions | 7.4.33-150400.4.16.1 |
php7-test openSUSE:Leap 15.4 | All versions | 7.4.33-150400.4.16.1 |
php8 openSUSE:Leap 15.4 | All versions | 8.0.27-150400.4.23.1 |
php8-embed openSUSE:Leap 15.4 | All versions | 8.0.27-150400.4.23.1 |
php8-fastcgi openSUSE:Leap 15.4 | All versions | 8.0.27-150400.4.23.1 |
php8-fpm openSUSE:Leap 15.4 | All versions | 8.0.27-150400.4.23.1 |
php8-test openSUSE:Leap 15.4 | All versions | 8.0.27-150400.4.23.1 |
php8 openSUSE:Tumbleweed | All versions | 8.1.14-1.1 |
Products include Php Php.
How do I fix CVE-2022-31631?
Upgrade libphp to a fixed version for your release line: 8.0.27, 8.1.15 or 8.2.2.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-31631 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31631 exists.
Other vulnerabilities in Php Php
Sources
Also known as BIT-libphp-2022-31631, BIT-php-2022-31631, BIT-php-min-2022-31631, DEBIAN-CVE-2022-31631, ECHO-ed42-71c8-1af5, GHSA-4qmr-c42j-3wg2 and 7 more.