Read the docs
TI-2016-06306 Aliases CVE-2016-7405GHSA-3fj4-q72x-x2g9

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7…

Priority MEDIUM 47CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.

Why it matters now

EPSS 0.02984 87th percentileScored 2026-11-07
Fix Fixed adodb/adodb-php (Packagist): 5.20.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—adodb/adodb-php (Packagist)5.0 to before 5.20.75.20.7Patch availableGHSA-3fj4-q72x-x2g9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • adodb/adodb-php (Packagist) Vendor— Affected 5.0 to before 5.20.7 Fixed in 5.20.7 Patch available GHSA-3fj4-q72x-x2g9

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:adodb_project:adodb:5.00:beta:*:*:*:*:*:*5.00 betaVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.01:beta:*:*:*:*:*:*5.01 betaVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.02:*:*:*:*:*:*:*5.02VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.02:a:*:*:*:*:*:*5.02 aVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.03:*:*:*:*:*:*:*5.03VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.04:*:*:*:*:*:*:*5.04VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.04:a:*:*:*:*:*:*5.04 aVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.05:*:*:*:*:*:*:*5.05VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.06:*:*:*:*:*:*:*5.06VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.06:a:*:*:*:*:*:*5.06 aVulnerableAdodb Project
  • cpe:2.3:a:adodb_project:adodb:5.00:beta:*:*:*:*:*:* Versions 5.00 beta Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.01:beta:*:*:*:*:*:* Versions 5.01 beta Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.02:*:*:*:*:*:*:* Versions 5.02 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.02:a:*:*:*:*:*:* Versions 5.02 a Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.03:*:*:*:*:*:*:* Versions 5.03 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.04:a:*:*:*:*:*:* Versions 5.04 a Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.05:*:*:*:*:*:*:* Versions 5.05 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.06:*:*:*:*:*:*:* Versions 5.06 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.06:a:*:*:*:*:*:* Versions 5.06 a Vulnerable ·Adodb Project
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adodb_project:adodb:5.07:*:*:*:*:*:*:*5.07VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.08:*:*:*:*:*:*:*5.08VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.08:a:*:*:*:*:*:*5.08 aVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.09:*:*:*:*:*:*:*5.09VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.09:a:*:*:*:*:*:*5.09 aVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.10:*:*:*:*:*:*:*5.10VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.11:*:*:*:*:*:*:*5.11VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.12:*:*:*:*:*:*:*5.12VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.13:*:*:*:*:*:*:*5.13VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.14:*:*:*:*:*:*:*5.14VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.15:*:*:*:*:*:*:*5.15VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.16:*:*:*:*:*:*:*5.16VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.16:a:*:*:*:*:*:*5.16 aVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.17:*:*:*:*:*:*:*5.17VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.18:*:*:*:*:*:*:*5.18VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.18:a:*:*:*:*:*:*5.18 aVulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.19:*:*:*:*:*:*:*5.19VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.20.0:*:*:*:*:*:*:*5.20.0VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.20.1:*:*:*:*:*:*:*5.20.1VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.20.2:*:*:*:*:*:*:*5.20.2VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.20.3:*:*:*:*:*:*:*5.20.3VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.20.4:*:*:*:*:*:*:*5.20.4VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.20.5:*:*:*:*:*:*:*5.20.5VulnerableAdodb Project
cpe:2.3:a:adodb_project:adodb:5.20.6:*:*:*:*:*:*:*5.20.6VulnerableAdodb Project
cpe:2.3:a:php:php:-:*:*:*:*:*:*:*not specified by NVDRunning onPHP
cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*25VulnerableFedoraproject
  • cpe:2.3:a:adodb_project:adodb:5.07:*:*:*:*:*:*:* Versions 5.07 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.08:*:*:*:*:*:*:* Versions 5.08 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.08:a:*:*:*:*:*:* Versions 5.08 a Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.09:*:*:*:*:*:*:* Versions 5.09 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.09:a:*:*:*:*:*:* Versions 5.09 a Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.10:*:*:*:*:*:*:* Versions 5.10 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.11:*:*:*:*:*:*:* Versions 5.11 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.12:*:*:*:*:*:*:* Versions 5.12 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.13:*:*:*:*:*:*:* Versions 5.13 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.14:*:*:*:*:*:*:* Versions 5.14 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.15:*:*:*:*:*:*:* Versions 5.15 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.16:*:*:*:*:*:*:* Versions 5.16 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.16:a:*:*:*:*:*:* Versions 5.16 a Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.17:*:*:*:*:*:*:* Versions 5.17 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.18:*:*:*:*:*:*:* Versions 5.18 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.18:a:*:*:*:*:*:* Versions 5.18 a Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.19:*:*:*:*:*:*:* Versions 5.19 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.20.0:*:*:*:*:*:*:* Versions 5.20.0 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.20.1:*:*:*:*:*:*:* Versions 5.20.1 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.20.2:*:*:*:*:*:*:* Versions 5.20.2 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.20.3:*:*:*:*:*:*:* Versions 5.20.3 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.20.4:*:*:*:*:*:*:* Versions 5.20.4 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.20.5:*:*:*:*:*:*:* Versions 5.20.5 Vulnerable ·Adodb Project
  • cpe:2.3:a:adodb_project:adodb:5.20.6:*:*:*:*:*:*:* Versions 5.20.6 Vulnerable ·Adodb Project
  • cpe:2.3:a:php:php:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·PHP
  • cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:* Versions 25 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-3fj4-q72x-x2g9 adodb/adodb-php (Packagist) Fixed in 5.20.7 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-7405
  2. 2026-10-03 Alias added: GHSA-3fj4-q72x-x2g9

References

Patch 5

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences