CVE-2025-14179

CVE-2025-14179 describes a vulnerability within the PDO Firebird driver in specific versions of PHP. This flaw affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. The vulnerability arises from the improper handling of NUL bytes during the preparation of SQL queries. When a string token containing a NUL byte is copied via `strncat()`, the function stops at the NUL byte, which can cause the closing quote of the string to be dropped. This leads to subsequent SQL tokens being misinterpreted as part of the string, ultimately allowing for SQL injection when attacker-controlled values are quoted using `PDO::quote()` and embedded in SQL statements.