The PDO Firebird driver in PHP mishandles NUL bytes when building SQL queries. When a NUL byte appears inside a quoted string literal, the internal string copy stops prematurely, dropping the closing quote and causing the rest of the query to be parsed as part of that string. An attacker can therefore inject arbitrary SQL by supplying a NUL byte in a value that is quoted with PDO::quote() and then concatenated into a Firebird statement. This classic injection flaw is identified by CWE‑89 and can compromise confidentiality, integrity, or availability of the targeted database.

Affected systems are installations of PHP from the PHP Group that use the PDO Firebird driver and run any release block preceding the fixes: PHP 8.2.x before 8.2.31, PHP 8.3.x before 8.3.31, PHP 8.4.x before 8.4.21, and PHP 8.5.x before 8.5.6. Any application that accepts user input, applies PDO::quote(), and embeds the result directly into a Firebird query is vulnerable.

The risk is moderate to high, with a CVSS score of 7.4. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an application that accepts user input, applies PDO::quote() to that input, and embeds it directly into a Firebird SQL query. Since the vulnerability is triggered by the presence of NUL bytes, attackers can craft input containing such bytes to subvert query parsing once the PHP code is executed on the server.