Description

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

Remediation

References

CVE-2022-31625

Related Vulnerabilities

WordPress Plugin Sidebar Login Cross-Site Scripting (2.3.6)

Squid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-12529)

Atlassian Jira Missing Authorization Vulnerability (CVE-2019-3399)

XWikiplatform Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2024-56158)

Perl Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-1999-1386)

Severity

High

Classification

CVE-2022-31625 CWE-763 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities