{"id":"CVE-2016-7405","aliases":["DEBIAN-CVE-2016-7405","DLA-620-1","EUVD-2022-2169","GHSA-3fj4-q72x-x2g9","MGASA-2016-0363","UBUNTU-CVE-2016-7405","USN-6825-1"],"status":"published","title":"ADOdb Library SQL Injection","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02984,"percentile":0.87387,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2016-09-13T00:00:00Z","modified":"2026-10-20T10:47:39Z","fixes":[{"ecosystem":"Packagist","package":"adodb/adodb-php","fixed_in":["5.20.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libphp-adodb","fixed_in":["5.20.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libphp-adodb","fixed_in":["5.20.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libphp-adodb","fixed_in":["5.20.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-adodb","fixed_in":["5.20.3-1ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"adodb/adodb-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.20.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15-1+deb7u1"}]}],"versions":["5.15-1"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"adodb/adodb-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.20.7"}]}],"versions":["v5.19","v5.20.0","v5.20.1","v5.20.2","v5.20.3","v5.20.4","v5.20.5","v5.20.6"]},{"source":"osv","ecosystem":"Mageia:5","package":"php-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18-5.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.3-1ubuntu1+esm1"}]}],"versions":["5.18a-1","5.20.1-1","5.20.2-1","5.20.2-2","5.20.3-1","5.20.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.3-1ubuntu1+esm1"}]}],"versions":["5.18a-1","5.20.1-1","5.20.2-1","5.20.2-2","5.20.3-1","5.20.3-1ubuntu1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.9-1ubuntu0.1~esm1"}]}],"versions":["5.20.9-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.16-1ubuntu0.1~esm1"}]}],"versions":["5.20.14-1","5.20.15-1","5.20.16-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.19-1ubuntu0.1"}]}],"versions":["5.20.19-1"],"bundled":3}],"products":[{"vendor":"adodb_project","product":"adodb"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/07/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Release Notes","fix","web","report"]},{"url":"http://www.securityfocus.com/bid/92969","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ADOdb/ADOdb/issues/226","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web","report"]},{"url":"https://security.gentoo.org/glsa/201701-59","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/15/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Release Notes","fix","web"]},{"url":"https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md","tags":["x_refsource_CONFIRM","x_transferred","Patch","Release Notes","Vendor Advisory","fix","web"]},{"url":"https://github.com/ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7405","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y/"},{"url":"https://web.archive.org/web/20210123170727/http://www.securityfocus.com/bid/92969","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3fj4-q72x-x2g9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7405","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0363.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19307","tags":["report"]},{"url":"http://lwn.net/Alerts/700508/","tags":["web"]},{"url":"http://lwn.net/Vulnerabilities/701151/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7405","tags":["report"]},{"url":"https://github.com/ADOdb/ADOdb/commit/bd9eca9","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7405","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6825-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-4855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3850","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7405","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2016-10-03T18:00:00Z","modified":"2024-08-06T01:57:47.607Z","updated_at":"2026-11-02T14:33:36.802481Z"}],"euvd":[{"id":"EUVD-2022-2169","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2016-10-03T18:00:00Z","modified":"2024-08-06T01:57:47Z","updated_at":"2026-11-03T02:22:32.403524Z"}],"ghsa":[{"id":"GHSA-3fj4-q72x-x2g9","title":"ADOdb Library SQL Injection","description":"The `qstr` method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2022-05-17T02:37:05Z","modified":"2023-09-08T10:25:24Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:03.287418Z"}],"nvd":[{"id":"CVE-2016-7405","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2016-10-03T18:59:14.15Z","modified":"2026-06-17T00:53:00.16Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"CVE-2016-7405","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2016-10-03T18:59:14.15Z","modified":"2026-10-20T10:47:39.959969547Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-7405","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2016-10-03T18:59:14.15Z","modified":"2026-09-22T07:01:35.369569557Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"GHSA-3fj4-q72x-x2g9","title":"ADOdb Library SQL Injection","description":"The `qstr` method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2022-05-17T02:37:05Z","modified":"2024-02-21T05:32:01.394052Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"UBUNTU-CVE-2016-7405","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.","status":"published","published":"2016-10-03T18:59:00Z","modified":"2026-02-04T04:30:05.452268Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-620-1","title":"libphp-adodb - security update","status":"published","published":"2016-09-13T00:00:00Z","modified":"2026-03-09T02:09:23.22975Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0363","title":"Updated php-adodb packages fix security vulnerabilities","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x \nbefore 5.20.7 might allow remote attackers to conduct SQL injection attacks \nvia vectors related to incorrect quoting. (CVE-2016-7405)\n\nCross Site Scripting vulnerability in test script (CVE-2016-4855)\n","status":"published","published":"2016-11-03T22:53:34Z","modified":"2026-04-16T06:25:28.352831076Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-6825-1","title":"libphp-adodb vulnerabilities","description":"It was discovered that the PDO driver in ADOdb was incorrectly handling\nstring quotes. A remote attacker could possibly use this issue to \nperform SQL injection attacks. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2016-7405)\n\nIt was discovered that ADOdb was incorrectly handling GET parameters in \ntest.php. A remote attacker could possibly use this issue to execute \ncross-site scripting (XSS) attacks. This issue only affected Ubuntu \n16.04 LTS. (CVE-2016-4855)\n\nEmmet Leahy discovered that ADOdb was incorrectly handling string quotes\nin PostgreSQL connections. A remote attacker could possibly use this issue\nto bypass authentication. (CVE-2021-3850)\n","status":"published","published":"2024-06-10T20:41:56Z","modified":"2026-06-25T13:30:34.62610008Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}