PHP PDO Flaw Allows Attackers to Inject Malicious SQL Commands

A critical vulnerability in PHP’s widely-used PDO (PHP Data Objects) library has been discovered that enables attackers to inject malicious SQL commands even when developers implement prepared statements correctly.

The security flaw, revealed through analysis of a DownUnderCTF capture-the-flag challenge, exploits weaknesses in PDO’s SQL parser and affects millions of web applications worldwide.

Technical Overview of the Vulnerability

The vulnerability stems from PDO’s default behavior of emulating prepared statements rather than using native database-prepared statements.

PDO implements its own SQL parser to handle bound parameters, but this parser can be tricked into misinterpreting user input as bound parameters in contexts where they shouldn’t be treated as such.

The attack technique involves exploiting scenarios where user input appears directly in prepared statements, particularly for column and table names that cannot be bound as parameters. Consider this seemingly secure code example:

prepare("SELECT $col FROM fruit WHERE name ...