Summary
sqlparse through version 0.6.0 can permit PHP code injection when SQL text containing unescaped dollar signs is processed by OutputPHPFilter. If an attacker can influence the SQL text and the generated PHP snippet is subsequently executed, embedded expression sequences may run arbitrary PHP code.
sqlparse through version 0.6.0 can permit PHP code injection when SQL text containing unescaped dollar signs is processed by OutputPHPFilter. If an attacker can influence the SQL text and the generated PHP snippet is subsequently executed, embedded expression sequences may run arbitrary PHP code.
Affected context
The vulnerability occurs in deployments that use sqlparse's OutputPHPFilter to generate PHP code from attacker-influenced SQL text. It becomes risky when dollar signs and expression-like sequences are copied into double-quoted PHP strings without escaping or contextual encoding, and the resulting snippet is later interpreted by a PHP runtime.
The vulnerability occurs in deployments that use sqlparse's OutputPHPFilter to generate PHP code from attacker-influenced SQL text. It becomes risky when dollar signs and expression-like sequences are copied into double-quoted PHP strings without escaping or contextual encoding, and the resulting snippet is later interpreted by a PHP runtime.
Exploit preconditions
- Attack surface: SQL text processed by the OutputPHPFilter code-generation path
- Required access: Ability to supply or influence SQL text that reaches the filter
- Trigger point: Generation and subsequent execution or evaluation of the produced PHP snippet
- Why exploitation is possible: Unescaped dollar-sign sequences can be interpreted as PHP expressions within generated double-quoted strings
- Attack surface: SQL text processed by the OutputPHPFilter code-generation path
- Required access: Ability to supply or influence SQL text that reaches the filter
- Trigger point: Generation and subsequent execution or evaluation of the produced PHP snippet
- Why exploitation is possible: Unescaped dollar-sign sequences can be interpreted as PHP expressions within generated double-quoted strings
Why this happens
The underlying flaw is a failure to treat input SQL text as data when generating PHP source code. OutputPHPFilter places unescaped dollar-sign expression sequences into double-quoted strings, allowing PHP interpolation syntax to cross the intended data/code boundary. This maps to CWE-94: Improper Control of Generation of Code, because externally influenced content can alter generated executable PHP logic.
The underlying flaw is a failure to treat input SQL text as data when generating PHP source code. OutputPHPFilter places unescaped dollar-sign expression sequences into double-quoted strings, allowing PHP interpolation syntax to cross the intended data/code boundary. This maps to CWE-94: Improper Control of Generation of Code, because externally influenced content can alter generated executable PHP logic.
Potential impact
- Arbitrary PHP expressions may execute in the context of the generated snippet
- An attacker could access or alter data available to the PHP process
- Application integrity and confidentiality could be compromised
- The vulnerable service may be used for further server-side actions
- Arbitrary PHP expressions may execute in the context of the generated snippet
- An attacker could access or alter data available to the PHP process
- Application integrity and confidentiality could be compromised
- The vulnerable service may be used for further server-side actions
General mitigation guidance
Mitigation generally focuses on preventing untrusted SQL text from becoming executable PHP source.
Common defensive patterns include:
- Avoiding source-code generation when a data-oriented representation or parameterized execution model is sufficient
- Applying context-appropriate escaping or encoding before inserting values into PHP strings
- Treating all SQL text and generated content as untrusted until it passes strict validation
- Restricting which callers can request PHP code generation and limiting execution privileges
- Separating code generation from code execution and disabling dynamic evaluation where it is not required
- Using isolated, least-privileged runtime environments for generated code
Mitigation generally focuses on preventing untrusted SQL text from becoming executable PHP source.
Common defensive patterns include:
- Avoiding source-code generation when a data-oriented representation or parameterized execution model is sufficient
- Applying context-appropriate escaping or encoding before inserting values into PHP strings
- Treating all SQL text and generated content as untrusted until it passes strict validation
- Restricting which callers can request PHP code generation and limiting execution privileges
- Separating code generation from code execution and disabling dynamic evaluation where it is not required
- Using isolated, least-privileged runtime environments for generated code
How teams detect issues like this
Organizations can look for:
- Static analysis findings where user-controlled SQL or text flows into PHP source generation
- Code review signals involving string interpolation, dollar signs, or generated double-quoted PHP strings
- Tests containing expression-like sequences and other metacharacters in SQL inputs
- Policy checks that prohibit dynamic evaluation or unrestricted generated-code execution
- Runtime monitoring for unexpected PHP process behavior, generated source execution, or anomalous file and network access
Automated security review tools may help identify data-to-code flows, but findings should be validated against the actual generation and execution path.
Organizations can look for:
- Static analysis findings where user-controlled SQL or text flows into PHP source generation
- Code review signals involving string interpolation, dollar signs, or generated double-quoted PHP strings
- Tests containing expression-like sequences and other metacharacters in SQL inputs
- Policy checks that prohibit dynamic evaluation or unrestricted generated-code execution
- Runtime monitoring for unexpected PHP process behavior, generated source execution, or anomalous file and network access
Automated security review tools may help identify data-to-code flows, but findings should be validated against the actual generation and execution path.
