DBAL 3 SQL Injection Security Vulnerability

CRITIQUE 9.8CVE-2021-43608 · GHSA-r7cj-8hjg-x622 · Published 09/12/2021 · updated 17/06/2026

En bref

CVE-2021-43608 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant doctrine/dbal, database abstraction layer (doctrine-project).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.4%, plus élevée que 84.4% des vulnérabilités.
Correctif : mettre à jour vers 3.1.4 ou plus récent.

Package	Affected versions	Patched versions
doctrine/dbal Packagist	`≥ 3.0.0, < 3.1.4`	`3.1.4`
database abstraction layer doctrine-project	`≥ 3.0.0, < 3.1.4`	`3.1.4`

Description

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.

We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.

The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling AbstractPlatform::modifyLimitQuery.

As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.

This vulnerability has been assigned CVE-2021-43608.

NVD description

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.

References

doctrine/dbal security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-43608 · ADVISORY
doctrine/dbal commit 9dcfa4c · WEB
FriendsOfPHP/security-advisories · WEB
doctrine/dbal · WEB
doctrine/dbal release · WEB
doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html · WEB

Autres vulnérabilités de doctrine/dbal

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

doctrine/dbal

Packagist

≥ 3.0.0, < 3.1.4

3.1.4

database abstraction layer

doctrine-project

≥ 3.0.0, < 3.1.4

3.1.4

Description

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.

We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.

The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling AbstractPlatform::modifyLimitQuery.

As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.

This vulnerability has been assigned CVE-2021-43608.

NVD description