---
id: 4078
title: "Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/hack-the-elephant-one-bite-at-a-time-nul-byte-sql-injection-in-pdo_firebird-and-null-pointer-dereference-in-pdo-pgsql/"
published_at: "2026-07-06 11:06"
tags: ["vulnerability-research", "memory-safety", "denial-of-service", "php", "sql-injection", "pdo", "firebird", "cve-2025-14179", "cve-2025-14180"]
phying_url: "https://phying.com/item/4078"
lang: en
---

# Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql

## Summary

Positive Technologies details two PHP PDO flaws: CVE-2025-14179, SQL injection in pdo_firebird via NUL bytes in quoted strings, and CVE-2025-14180, a NULL pointer dereference in PDO quoting.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2026-07-06 11:06
- **Original:** https://swarm.ptsecurity.com/hack-the-elephant-one-bite-at-a-time-nul-byte-sql-injection-in-pdo_firebird-and-null-pointer-dereference-in-pdo-pgsql/
- **Phying News:** https://phying.com/item/4078