Summary
It was discovered that the PDO driver in ADOdb was incorrectly handling
string quotes. A remote attacker could possibly use this issue to
perform SQL injection attacks. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-7405)
It was discovered that ADOdb was incorrectly handling GET parameters in
test.php. A remote attacker could possibly use this issue to execute
cross-site scripting (XSS) attacks. This issue only affected Ubuntu
16.04 LTS. (CVE-2016-4855)
Emmet Leahy discovered that ADOdb was incorrectly handling string quotes
in PostgreSQL connections. A remote attacker could possibly use this issue
to bypass authentication. (CVE-2021-3850)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libphp-adodb | 5.20.19-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libphp-adodb | 5.20.3-1ubuntu1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libphp-adodb | 5.20.9-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libphp-adodb | 5.20.16-1ubuntu0.1~esm1 |
Vulnerabilities 3
-
Critical 9.8
ADOdb Library SQL Injection
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
-
Critical 9.1
Authentication Bypass by Primary Weakness in adodb/adodb
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
-
Medium 6.1
ADOdb Cross-site scripting vulnerability in old test script
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.