Preliminary research

Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird

Hack the Elephant One Bite at a Time: NUL Byte SQL Injection in pdo_firebird and Null Pointer Dereference in pdo_pgsql

Aleksey Solovev and Nikita Sveshnikov · PT SWARM

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Traces Firebird PDO query reconstruction through NUL-terminated string operations. A quoted binary token loses its closing quote while reconstruction resumes at later tokens, making subsequent input become SQL syntax before native preparation. The article also examines a separate PDO PostgreSQL null-pointer failure.

Record

Document

Hack the Elephant One Bite at a Time: NUL Byte SQL Injection in pdo_firebird and Null Pointer Dereference in pdo_pgsql

Researcher

Aleksey Solovev and Nikita Sveshnikov

Published by

PT SWARM

Topic

Injection

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Attack arithmetic: integer overflow in PostgreSQL libpq
• Firebird client information disclosure Advisory
• CVE-2025-14179 Advisory
• CVE-2025-14180 Advisory

Tags

• php
• sqli
• parser-differential
• database
• dos
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Aleksey Solovev and Nikita Sveshnikov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.