Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql
swarm.ptsecurity.com | research | #vulnerability-research | #memory-safety | #denial-of-service | #php | #sql-injection | #pdo | #firebird | #cve-2025-14179 | #cve-2025-14180
Summary
Positive Technologies details two PHP PDO flaws: CVE-2025-14179, SQL injection in pdo_firebird via NUL bytes in quoted strings, and CVE-2025-14180, a NULL pointer dereference in PDO quoting.
- Published
- Collected
--- id: 4078 title: "Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql" source_domain: swarm.ptsecurity.com source_url: "https://swarm.ptsecurity.com/hack-the-elephant-one-bite-at-a-time-nul-byte-sql-injection-in-pdo_firebird-and-null-pointer-dereference-in-pdo-pgsql/" published_at: "2026-07-06 11:06" tags: ["vulnerability-research", "memory-safety", "denial-of-service", "php", "sql-injection", "pdo", "firebird", "cve-2025-14179", "cve-2025-14180"] phying_url: "https://phying.com/item/4078" lang: en --- # Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql ## Summary Positive Technologies details two PHP PDO flaws: CVE-2025-14179, SQL injection in pdo_firebird via NUL bytes in quoted strings, and CVE-2025-14180, a NULL pointer dereference in PDO quoting. ## Intelligence Metadata - **Sources:** swarm.ptsecurity.com - **Published:** 2026-07-06 11:06 - **Original:** https://swarm.ptsecurity.com/hack-the-elephant-one-bite-at-a-time-nul-byte-sql-injection-in-pdo_firebird-and-null-pointer-dereference-in-pdo-pgsql/ - **Phying News:** https://phying.com/item/4078