GHSA-h63c-xvpf-264j: 
PHP vulnerability analysis and mitigation

The ADOdb Library for PHP prior to version 5.20.11 contains a SQL injection vulnerability (GHSA-h63c-xvpf-264j) affecting multiple database drivers. The vulnerability was discovered in the SelectLimit function where the nrows and offset parameters were not properly sanitized by forcing them to integers, potentially allowing SQL injection attacks (GitHub Advisory).

The vulnerability exists in the SelectLimit function implementation across multiple database drivers where the nrows and offset parameters were not properly type-cast to integers. This affected various drivers including MySQL, PostgreSQL, SQLite, Oracle, and others. The issue was initially identified in the PDO MySQL driver and later found to affect other drivers that did not use ADOConnection::SelectLimit (ADOdb PR 311, ADOdb PR 401).

The vulnerability could allow attackers to perform SQL injection attacks through the nrows and offset parameters of the SelectLimit function. This could potentially lead to unauthorized access to the database, data manipulation, or exposure of sensitive information (GitHub Advisory).

The vulnerability was rated as Critical severity. It affected multiple database drivers in the ADOdb library and could be exploited through the SelectLimit function parameters. The vulnerability was present in all versions prior to 5.20.11 (GitHub Advisory).

The vulnerability was fixed in ADOdb version 5.20.11 by implementing proper integer type casting for the nrows and offset parameters in the SelectLimit function across all affected drivers. Users should upgrade to version 5.20.11 or later to address this security issue (ADOdb Commit).