[ GLSA 200602-02 ] ADOdb: PostgresSQL command injection

[GLSA]

Gentoo Linux Security Advisory

Title: ADOdb: PostgresSQL command injection (GLSA 200602-02)
Severity: normal
Exploitable: remote
Date: February 06, 2006
Bug(s): #120215
ID: 200602-02

Synopsis


ADOdb is vulnerable to SQL injections if used in conjunction with a
PostgreSQL database.


Background


ADOdb is an abstraction library for PHP creating a common API for
a wide range of database backends.


Affected Packages

Package: dev-php/adodb
Vulnerable: < 4.71
Unaffected: >= 4.71
Architectures: All supported architectures


Description


Andy Staudacher discovered that ADOdb does not properly sanitize
all parameters.


Impact


By sending specifically crafted requests to an application that
uses ADOdb and a PostgreSQL backend, an attacker might exploit the flaw
to execute arbitrary SQL queries on the host.


Workaround


There is no known workaround at this time.


Resolution


All ADOdb users should upgrade to the latest version: