CVE-2011-1522: Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery fu...

Security readout for executives and security teams

A flaw in Doctrine’s database abstraction layer can let remote users alter database queries when an application passes untrusted limit or offset values. For exposed applications using affected Doctrine versions, impact may include unauthorized data access or modification. The bundle does not show active exploitation or a CVSS score. Most likely in legacy PHP applications using old Doctrine 1.x or 2.x releases, especially public routes with user-controlled pagination parameters. Modern applications are exposed only if they still bundle or deploy the vulnerable Doctrine versions. Prioritize remediation for internet-facing legacy PHP applications using affected Doctrine releases. The business risk is potentially serious because SQL injection can compromise data confidentiality and integrity, but urgency should be based on confirmed vulnerable versions and reachable code paths. Mitigation focus: Upgrade Doctrine 1.x to at least 1.2.4 or 2.x to at least 2.0.3.; Apply vendor or distribution security updates where Doctrine is packaged by the OS.; Audit application pagination inputs for strict integer validation and bounds checking..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.