Introduction
A critical flaw in ADOdb's metadata retrieval functions exposes applications that use the library with SQLite3 to arbitrary SQL execution. The functions do not properly escape the table name parameter, so an attacker who can supply that value can compromise both the confidentiality and the integrity of the data.
About ADOdb: ADOdb is an open-source PHP library that gives applications one API for working with many database systems. It is widely used, including in enterprise software, content management systems, and research applications, so a flaw in its core components reaches across the PHP ecosystem.
Technical information
CVE-2025-54119 is a SQL injection vulnerability in ADOdb's SQLite3 driver, affecting versions 5.22.9 and below. The vulnerability is in these methods:
metaColumnsmetaForeignKeysmetaIndexes
Each method takes a $table parameter and uses it to build SQL queries that retrieve metadata about database tables, columns, and foreign keys. In affected versions, ADOdb concatenates $table into the SQL statement without properly escaping or sanitizing it. An attacker who controls the value passed to these methods can inject arbitrary SQL code.
The flaw is specific to the SQLite3 driver. ADOdb's other database drivers are not affected. The root cause is that the table name is neither validated nor parameterized, so it goes straight into the query.
No public code snippets are available, but the advisory and the commit history confirm where the flaw is and what it does.
Affected systems and versions
- Product: ADOdb PHP database abstraction library
- Affected versions: 5.22.9 and below
- Vulnerable configuration: Using the SQLite3 driver and calling
metaColumns,metaForeignKeys, ormetaIndexeswith user-controlled or unvalidated table names
Vendor security history
ADOdb has had SQL injection vulnerabilities in its database drivers before, including CVE-2025-46337 in the PostgreSQL driver. The maintainers have patched critical issues promptly and published public advisories for them. An active open-source team maintains the project, and outside security researchers contribute to it.
