This vulnerability involves improper neutralization of special elements in SQL commands (CWE-89) within the PHP PDO Firebird driver. Specifically, when preparing SQL queries, string tokens containing NUL bytes are copied using strncat(), which truncates at the NUL byte and drops the closing quote. This causes the SQL parser to treat subsequent tokens as part of the string, enabling SQL injection attacks if attacker-controlled input is quoted via PDO::quote() and embedded in SQL statements. The flaw affects multiple PHP 8.x versions prior to specified patch levels.

Successful exploitation could allow an attacker to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 score of 7.4 reflects a high severity with network attack vector, low attack complexity, partial user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor PHP Group advisories for updates and consider avoiding use of the PDO Firebird driver with untrusted input until a fix is released.