CVE-2024-12894: Pdo Param Int Sqli
Binding unvalidated or unsanitized user input to a PDO statement using `PDO::PARAM_INT` can lead to SQL Injection. If emulated prepared statements are enabled, PDO may fail to quote the string input, treating it as an integer and injecting the payload dynamically into the query. Ensure that the input is properly cast to an integer (e.g., using `(int)` or `in
PHPβgreprules fetch cve-2024-12894-pdo-param-int-sqli --engine opengrepDescription
Binding unvalidated or unsanitized user input to a PDO statement using `PDO::PARAM_INT` can lead to SQL Injection. If emulated prepared statements are enabled, PDO may fail to quote the string input, treating it as an integer and injecting the payload dynamically into the query. Ensure that the input is properly cast to an integer (e.g., using `(int)` or `in
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0