CVE-2022-31631
📋 TL;DR
This vulnerability in PHP's PDO::quote() function for SQLite allows SQL injection when processing overly long user-supplied strings. It affects PHP applications using SQLite database connections with PDO. Attackers can potentially execute arbitrary SQL commands through crafted input.
💻 Affected Systems
- PHP
📦 What is this software?
Php by Php
Php by Php
Php by Php
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data theft, modification, or deletion, and potential remote code execution through database functions.
Likely Case
SQL injection leading to data exfiltration, authentication bypass, or privilege escalation in affected applications.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
Exploitation requires user input to be passed through PDO::quote() for SQLite, which is common in many PHP applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PHP 8.0.27, PHP 8.1.15, PHP 8.2.2
Vendor Advisory: https://bugs.php.net/bug.php?id=81740
Restart Required: Yes
Instructions:
1. Update PHP to patched version using your package manager. 2. For Linux: apt-get update && apt-get install php8.1 (or appropriate version). 3. Restart web server (apache2 restart, systemctl restart php-fpm, etc.). 4. Verify PHP version with php -v.
🔧 Temporary Workarounds
Use parameterized queries
allReplace PDO::quote() usage with prepared statements and parameter binding to prevent SQL injection.
Input length validation
allImplement server-side validation to reject overly long strings before passing to PDO::quote().
🧯 If You Can't Patch
- Implement strict input validation and length limits on all user data passed to PDO::quote()
- Replace all PDO::quote() usage with parameterized prepared statements
🔍 How to Verify
Check if Vulnerable:
Check PHP version and if application uses PDO with SQLite and PDO::quote() on user input.Check Version:
php -v | grep "PHP"Verify Fix Applied:
Confirm PHP version is 8.0.27+, 8.1.15+, or 8.2.2+ and test SQLite PDO functionality.📡 Detection & Monitoring
Log Indicators:
- Unusually long SQL queries
- SQL syntax errors in logs
- Multiple failed login attempts from SQL injection
Network Indicators:
- Abnormal database query patterns
- Unexpected SQL commands in application traffic
SIEM Query:
source="web_logs" AND ("PDOException" OR "SQLite" OR "quote()") AND status=500