CVE-2022-31631

What it actually does

Uncaught integer overflow in PDO::quote() of PDO_SQLite causes sqlite3_snprintf to return a single apostrophe for oversized user input instead of a properly escaped string, bypassing intended quoting.

Why it matters to the business

Applications using PDO_SQLite for database queries may allow attackers to inject arbitrary SQL, risking unauthorized data access, modification, or deletion in production databases.

How an attack unfolds

An attacker supplies an extremely long string to a function that calls PDO::quote on untrusted input without length checks; the overflow causes the quoting function to emit only a single apostrophe, which the attacker then uses to terminate a SQL string literal and append malicious clauses.

How to fix it

Upgrade php-src to the commit 010300fb6bcd7c8e755cb63f9af159927b7831e8 or later; rebuild PHP with the patched PDO_SQLite driver and redeploy all affected applications.

How to confirm the fix worked

Confirm the installed php binary was built from a source tree containing commit 010300fb6bcd7c8e755cb63f9af159927b7831e8; test PDO::quote with inputs exceeding 2^31 bytes and verify the result is a properly escaped string rather than a lone apostrophe.

Typical attack path

1. Identify PHP application code paths that invoke PDO::quote on attacker-controlled strings passed to PDO_SQLite
2. Craft input whose length triggers the integer overflow in sqlite3_snprintf
3. Submit the payload so that the returned single apostrophe breaks SQL syntax
4. Append additional SQL statements or operators to achieve data exfiltration or modification

How to detect it

Review web-server and application logs for unusually long strings passed to PDO quote functions; inspect database query logs for sudden appearance of unquoted single apostrophes followed by SQL keywords; no public exploitation artifacts are known.

What your security team should do

• Immediately update all PHP builds to the fixed commit and verify the change in production
• Audit application code for direct use of PDO::quote on untrusted input and replace with prepared statements
• Add runtime length checks before calling quote on any user-supplied data
• Monitor EPSS and KEV feeds for future changes in exploit maturity