CVE-2026-25236
📋 TL;DR
This CVE describes a SQL injection vulnerability in PEAR, a PHP component framework, where unsafe literal substitution in karma queries allows attackers to inject malicious SQL. Systems using PEAR versions before 1.33.0 are affected. The vulnerability could allow unauthorized database access or manipulation.
💻 Affected Systems
- PEAR (PHP Extension and Application Repository)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion, and potential privilege escalation to execute arbitrary commands on the database server.
Likely Case
Unauthorized data access or modification in the PEAR database, potentially exposing user information, package metadata, or system configuration.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing read access to non-sensitive data.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity, but specific exploitation details aren't publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.33.0
Vendor Advisory: https://github.com/pear/pearweb/security/advisories/GHSA-95mc-p966-c29f
Restart Required: No
Instructions:
1. Update PEAR to version 1.33.0 or later using: pear upgrade pear
2. Verify the update completed successfully
3. Test affected functionality to ensure compatibility
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement strict input validation for all parameters used in karma queries
Database Permission Restriction
allLimit database user permissions to minimum required operations
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Disable or restrict access to affected karma query functionality if not essential
🔍 How to Verify
Check if Vulnerable:
Check PEAR version with: pear version | grep 'PEAR Version'Check Version:
pear version | grep 'PEAR Version'Verify Fix Applied:
Confirm version is 1.33.0 or higher with: pear version📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns in application logs
- SQL syntax errors in PHP error logs
- Multiple failed query attempts with special characters
Network Indicators:
- Unusual database connection patterns from web servers
- SQL error messages in HTTP responses
SIEM Query:
source="*php*" AND ("SQL syntax" OR "mysql_error" OR "pdo_exception") AND "pear"