Doctrine SQL injection vulnerability
Doctrine is prone to SQL injection vulnerability. Users of Doctrine 1.2 and 2 should update to the newly released versions of both libraries immediately. Both versions only include the security fix and no other changes to their previous versions 1.2.3 and 2.0.2.
Affected versions are:
- 1.2.3 and earlier for PostgreSQL and DB2 Dialects
- 2.0.2 and earlier
The security issue was found to affect the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery() function which does not cast input values for limit and offset to integer and allows malicious SQL to be executed if these parameters are passed into Doctrine 2 directly from request variables without previous cast to integer. Functionality building on top using limit queries in the ORM such as Doctrine\ORM\Query::setFirstResult() and Doctrine\ORM\Query::setMaxResults() are also affected by this security issue.
The fix for this security issue breaks backwards compatibility for developers that extend the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery() method, because it is now marked as final. Please overwrite the Doctrine\DBAL\Platforms\AbstractPlatform::doModifyLimitQuery() method instead.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | doctrine/orm | >= 2.0.0, < 2.0.3, >= 1.0.0, < 1.2.4 | 2.0.3, 1.2.4 |
References
- Weakness (CWE)
-- Platform
- Composer
- Package
doctrine/orm- Disclosed
- 15.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6q9v-4hq6-5m67 - CC BY 4.0
Vulnerability history: doctrine/orm
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 05.2022 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 0
-
Doctrine SQL injection vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.