CVE-2025-54119 ADOdb's sqlite3 driver allows SQL injection
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-54119?
CVE-2025-54119 is a critical vulnerability in ADOdb, published on 5 Aug 2025.
Official description
ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumns(), metaForeignKeys() or metaIndexes() methods with a crafted table name. This is fixed in version 5.22.10. To workaround this issue, only pass controlled data to metaColumns(), metaForeignKeys() and metaIndexes() method's $table parameter.
Weakness: CWE-89
Which versions are affected by CVE-2025-54119?
2 open source packages ship an affected version, including adodb/adodb-php.
| Package | Affected | Fixed in |
|---|---|---|
adodb/adodb-php Packagist | All versions | 5.22.10 |
adodb/adodb-php Packagist | All versions | 5.22.10 |
How do I fix CVE-2025-54119?
Upgrade adodb/adodb-php to 5.22.10 or later.
Is CVE-2025-54119 being exploited?
There is no known exploitation of CVE-2025-54119 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-54119, DLA-4340-1, GHSA-vf2r-cxg9-p7rf, UBUNTU-CVE-2025-54119.