CVE-2021-43608

CVE-2021-43608 is a critical SQL Injection vulnerability affecting Doctrine DBAL 3.x versions prior to 3.1.4. It arises from improper integer casting of offset and length inputs when generating a LIMIT clause, allowing attackers to inject malicious SQL if unescaped user input is passed to DBAL's QueryBuilder or other APIs utilizing AbstractPlatform::modifyLimitQuery. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a severe risk. It is easily exploitable over the network with low attack complexity and no user interaction required, potentially leading to full compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness despite its critical severity.