PHP Code Injection in sqlparse

The sqlparse library through version 0.6.0 contains a vulnerability categorized as PHP code injection. The issue arises within the OutputPHPFilter component, which improperly handles SQL input containing unescaped dollar signs. When an attacker provides a SQL string containing specific sequences such as ${expr} or {${expr}}, the filter incorrectly embeds these into double-quoted PHP strings. If the application environment subsequently executes the resulting snippet as PHP code, it allows for arbitrary code execution. This vulnerability is critical for applications that dynamically generate PHP code snippets from untrusted SQL input using this library. Defenders should note that the impact depends heavily on whether the downstream application executes the output generated by the vulnerable filter.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code within the context of the application server. This could lead to full application compromise, data exfiltration, or lateral movement within the network. The scope affects any application utilizing sqlparse to transform SQL into PHP-executable strings using the vulnerable OutputPHPFilter.

Recommendation

• Upgrade sqlparse to a version later than 0.6.0 where the improper handling of dollar signs in OutputPHPFilter is resolved.
• Audit all application code that utilizes sqlparse.OutputPHPFilter to determine if the generated output is evaluated or executed as PHP.
• Implement strict input validation on all SQL queries that are processed by the sqlparse library to ensure they do not contain untrusted or unexpected dollar sign sequences.