CVE-2022-31631

PDO::quote() may return unquoted string

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

We have discovered 127,062 live websites that are affected by CVE-2022-31631.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains127,062 live websites (1.74% of PHP install base)
Vulnerable Versions
  • from 8 through 8.0.27
  • from 8.1 through 8.1.15
  • from 8.2 through 8.2.2
Vulnerable Versions Count43 versions ( 8.33% of all versions)


Common Weakness Enumeration

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')



Details

  • Published - Feb 12, 2025
  • Updated - Feb 13, 2025

Website Distribution by Country

Number of websites using CVE-2022-31631
United States29,070 websites


France61,426 websites
Russia4,470 websites
Poland3,443 websites
Germany3,398 websites
Netherlands2,643 websites
Spain2,512 websites
Brazil2,271 websites
Italy1,970 websites
GB1,424 websites

Website Distribution by TLD

Number of websites using CVE-2022-31631
.com46,862 websites
.fr25,778 websites
.org5,809 websites
.ru4,459 websites
.net3,812 websites
.pl3,253 websites
.it3,194 websites
.be3,107 websites
.de2,568 websites
.nl2,452 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-31631

Top websites that are affected by CVE-2022-31631. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.edu United States*,***
***************.com Singapore*,***
***********.com United States*,***
******************.com Singapore**,***
****.org United States**,***
**********.com India**,***
***.org United States**,***
*****.sh Netherlands**,***
***.cc Cocos(Keeling) Island**,***
*****.de Germany**,***
See full domain list

FAQ

CVE-2022-31631 is Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in PHP
A total of 127,062 websites have been identified as vulnerable to CVE-2022-31631, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2022-31631 vulnerability.
PHP versions up to 8.2.2 are vulnerable to CVE-2022-31631.
CVE-2022-31631 is resolved in version 8.2.2 of PHP.