CVE-2025-54119: The ADOdb sqlite3 driver allows SQL injection

The vulnerability exists within the ADOdb library's sqlite3 driver. The root cause is the improper handling of user-supplied table names in three specific metadata functions: metaColumns, metaForeignKeys, and metaIndexes. In all three cases, the $table parameter, which can be controlled by an attacker, was directly concatenated or formatted into the SQL query string instead of being treated as a parameter. This allows for classic SQL injection attacks.

The provided patch addresses these vulnerabilities by consistently replacing string concatenation and sprintf formatting with parameterized queries. By using ? as a placeholder and passing the table name as a separate parameter to the execute, getOne, or getAll methods, the driver ensures that the input is treated as a single, literal value rather than executable SQL code. This effectively neutralizes the injection vector.

Any system using the ADOdb library with the sqlite3 driver and passing untrusted data to metaColumns(), metaForeignKeys(), or metaIndexes() is at risk. An attacker could exploit this to read, modify, or delete data in the database, and in some configurations, potentially achieve remote code execution on the server.