The PHP development team has identified three critical security vulnerabilities impacting core extensions, with patches released in versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9 of PHP This article explores attacks php_pgsql_add_quotes attacker. . These flaws encompass SQL injection, uncontrolled recursion, and out-of-bounds memory writes, affecting applications utilizing ext-pgsql, ext-phar, and ext-bcmath.
This function employs PQescapeStringConn() to sanitize input before wrapping it within a PostgreSQL escape string constant (E'...'), facilitating SQL injection attacks through php_pgsql_add_quotes(). An attacker can create a tar-based phar archive containing two symlinks pointing to each other, leading to infinite recursion upon accessing the entry content (e.g., via getContent()). The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates high availability impact with no confidentiality or integrity loss.
Since BCMath allocates memory on the stack before falling back to heap allocation, this can result in either stack or heap corruption depending on the context (CWE-121, CWE-787). Organizations using PHP applications that communicate with PostgreSQL must upgrade their processes involving untrusted Phar archives immediately, especially due to the risk of SQL injection leading to data exfiltration and memory corruption bugs enabling potential exploitation. By utilizing ANY.RUN for SOC investigations, organizations can mitigate blind spots, contain threats earlier, and minimize response costs and business disruptions.
