CVE-2022-31626

HIGH

PHP <7.4.30, <8.0.20, and <8.1.7 - Code Execution via pdo_mysql Buffer Overflow

Title source: manual

Exploitation Summary

EIP tracks 2 public exploits for CVE-2022-31626. PoCs published by amitlttwo, HORKimhab.

AI-analyzed exploit summary This PoC exploits a buffer overflow in PHP's pdo_mysql extension (CVE-2022-31626) by sending a crafted POST request with an excessively long password, leading to remote code execution. The exploit includes heap manipulation and memory leak techniques to achieve reliability.

Description

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.

Exploits (2)

nomisec WORKING POC 6 stars

by amitlttwo · poc

https://github.com/amitlttwo/CVE-2022-31626

View Code ZIP pw:eip

This PoC exploits a buffer overflow in PHP's pdo_mysql extension (CVE-2022-31626) by sending a crafted POST request with an excessively long password, leading to remote code execution. The exploit includes heap manipulation and memory leak techniques to achieve reliability.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Complex

Reliability

Reliable

Target: PHP 7.4.x < 7.4.30, 8.0.x < 8.0.20, 8.1.x < 8.1.7 with pdo_mysql and mysqlnd

No auth needed

Prerequisites: Target must be running vulnerable PHP version with pdo_mysql and mysqlnd · Attacker must be able to send POST requests to the target

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

github WORKING POC

by HORKimhab · pythonpoc

https://github.com/HORKimhab/CVE-2022-31626-CVE-2024-2961-CVE-2019-6977

View Code ZIP pw:eip

This repository contains functional exploit code for CVE-2022-31626, a PHP remote code execution vulnerability via improper handling of MySQL connections and memory corruption in the PHP MySQLi extension. The exploit leverages heap manipulation and memory leaks to achieve arbitrary code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Complex

Reliability

Racy

Target: PHP with MySQLi extension (versions affected by CVE-2022-31626)

No auth needed

Prerequisites: PHP application using MySQLi extension with specific memory layout conditions · Ability to send crafted HTTP requests to the target · Target PHP version vulnerable to CVE-2022-31626

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Aug 06, 2026 Full analysis →