Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 php8.2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.33-1~deb12u1"}]}]

Debian:13 php8.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1~deb13u1"}]}]

Debian:14 php8.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1"}]}]

参照URL

advisory security-tracker.debian.org