GHSA-6q9v-4hq6-5m67: 
PHP vulnerability analysis and mitigation

A critical SQL injection vulnerability was discovered in Doctrine ORM, affecting versions 2.0.0-2.0.2 and 1.0.0-1.2.3. The vulnerability was identified on September 25, 2011, and immediate updates were released with versions 1.2.4 and 2.0.3 to address this security issue. The vulnerability specifically affected PostgreSQL and DB2 Dialects in the database abstraction layer (GitHub Advisory, Doctrine Blog).

The vulnerability was found in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery() function, which failed to properly cast input values for limit and offset parameters to integers. This oversight allowed potential execution of malicious SQL when these parameters were passed directly from request variables without proper integer type casting. The issue also affected higher-level ORM functionality, specifically the Doctrine\ORM\Query::setFirstResult() and Doctrine\ORM\Query::setMaxResults() methods (Doctrine Blog).

The vulnerability could allow malicious actors to execute arbitrary SQL commands through the affected limit and offset parameters, potentially compromising the security of applications using the affected Doctrine versions. This was particularly critical for applications that passed request variables directly to these methods without proper input validation (GitHub Advisory).

The vulnerability could be exploited when request variables were passed directly into Doctrine 2 without proper integer casting, specifically through the limit and offset parameters in query functions. The issue was particularly relevant for PostgreSQL and DB2 Dialects users (Doctrine Blog).

Users were strongly urged to update immediately to versions 1.2.4 or 2.0.3, which contained the security fix. The fix involved marking the modifyLimitQuery() method as final and introducing a new doModifyLimitQuery() method for extending functionality. Developers who previously extended the modifyLimitQuery() method needed to update their code to override doModifyLimitQuery() instead (Doctrine Blog).