CVE-2026-17543 in PHP
Summary
by MITRE • 07/30/2026
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical SQL injection flaw in PHP's handling of backslash escaping within user-provided parameters, affecting multiple PHP version streams including 8.2.x through 8.5.x. The issue stems from improper sanitization of backslash characters in parameter processing, creating opportunities for attackers to inject malicious SQL commands through crafted input sequences. The vulnerability specifically impacts PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9 respectively, indicating a widespread exposure across the PHP ecosystem.
The technical root cause involves PHP's internal handling of backslash escaping in string processing functions that interact with database queries. When user-supplied parameters containing backslashes are processed without proper escaping mechanisms, the database driver may interpret these characters as SQL metacharacters rather than literal values. This creates a direct pathway for attackers to manipulate query execution flow through parameter injection attacks. The vulnerability manifests when PHP applications use user input directly in SQL queries without adequate sanitization or prepared statement usage, making it particularly dangerous in applications with dynamic query construction.
From an operational perspective, this vulnerability poses significant risk to web applications that rely on PHP for database interactions, potentially allowing attackers to extract sensitive data, modify database contents, or escalate privileges. The impact extends beyond simple data theft to include complete system compromise when combined with other attack vectors. Organizations running affected PHP versions face immediate exposure risks as the vulnerability can be exploited through standard web application attack methods without requiring specialized tools or techniques. The widespread nature of PHP usage across web applications means that numerous systems could be vulnerable, regardless of their specific implementation details.
The vulnerability aligns with CWE-74 and CWE-89, which cover improper neutralization of special elements used in data queries and SQL injection respectively. It also maps to ATT&CK technique T1071.004 for application layer protocol manipulation and T1566 for phishing attacks that could leverage this vulnerability for initial access. Organizations should immediately apply patches from PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9 respectively or implement compensating controls such as input validation, parameterized queries, and web application firewalls to mitigate the risk. Additionally, comprehensive security auditing of all PHP applications should be conducted to identify potential exploitation points and ensure proper implementation of database access controls.