Vulnerability CVE-2016-7405

Vulnerability Name:

CVE-2016-7405 (CCN-117472)

Assigned:

2016-10-03

Published:

2016-10-03

Updated:

2017-07-01

Summary:

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.4 Critical (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.4 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-89

Vulnerability Consequences:

Data Manipulation

References:

Source: MITRE
Type: CNA
CVE-2016-7405

Source: CCN
Type: oss-sec Mailing List, Wed, 07 Sep 2016 19:30:28 +0200
ADOdb PDO driver: incorrect quoting may allow SQL injection

Source: MLIST
Type: Patch, Release Notes
[oss-security] 20160907 ADOdb PDO driver: incorrect quoting may allow SQL injection

Source: MLIST
Type: Patch, Release Notes
[oss-security] 20160915 Re: ADOdb PDO driver: incorrect quoting may allow SQL injection

Source: BID
Type: Third Party Advisory
92969

Source: CCN
Type: BID-92969
ADOdb CVE-2016-7405 SQL Injection Vulnerability

Source: XF
Type: UNKNOWN
adodb-cve20167405-sql-injection(117472)

Source: CCN
Type: ADOdb GIT Repository
ADOdb library for PHP · GitHub

Source: CONFIRM
Type: Patch, Release Notes, Vendor Advisory
https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md

Source: CONFIRM
Type: Patch, Vendor Advisory
https://github.com/ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8

Source: CONFIRM
Type: Patch
https://github.com/ADOdb/ADOdb/issues/226

Source: FEDORA
Type: Third Party Advisory
FEDORA-2016-c5ec2c17e6

Source: GENTOO
Type: UNKNOWN
GLSA-201701-59

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2016-7405

Vulnerable Configuration:

Configuration 1:

cpe:/a:adodb_project:adodb:5.00:beta:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.01:beta:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.02:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.02:a:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.03:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.04:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.04:a:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.05:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.06:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.06:a:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.07:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.08:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.08:a:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.09:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.09:a:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.10:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.11:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.12:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.13:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.14:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.15:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.16:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.16:a:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.17:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.18:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.18:a:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.19:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.20.0:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.20.1:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.20.2:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.20.3:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.20.4:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.20.5:*:*:*:*:*:*:*

OR cpe:/a:adodb_project:adodb:5.20.6:*:*:*:*:*:*:*

AND

cpe:/a:php:php:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:fedoraproject:fedora:25:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:adodb_project:adodb:5.20.6:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:201674050000000	V	CVE-2016-7405 on Ubuntu 18.04 LTS (bionic) - medium.	2016-10-03
oval:com.ubuntu.artful:def:20167405000	V	CVE-2016-7405 on Ubuntu 17.10 (artful) - medium.	2016-10-03
oval:com.ubuntu.trusty:def:20167405000	V	CVE-2016-7405 on Ubuntu 14.04 LTS (trusty) - medium.	2016-10-03
oval:com.ubuntu.xenial:def:201674050000000	V	CVE-2016-7405 on Ubuntu 16.04 LTS (xenial) - medium.	2016-10-03
oval:com.ubuntu.bionic:def:20167405000	V	CVE-2016-7405 on Ubuntu 18.04 LTS (bionic) - medium.	2016-10-03
oval:com.ubuntu.xenial:def:20167405000	V	CVE-2016-7405 on Ubuntu 16.04 LTS (xenial) - medium.	2016-10-03
oval:com.ubuntu.cosmic:def:20167405000	V	CVE-2016-7405 on Ubuntu 18.10 (cosmic) - medium.	2016-10-03
oval:com.ubuntu.cosmic:def:201674050000000	V	CVE-2016-7405 on Ubuntu 18.10 (cosmic) - medium.	2016-10-03
oval:com.ubuntu.precise:def:20167405000	V	CVE-2016-7405 on Ubuntu 12.04 LTS (precise) - medium.	2016-10-03

BACK