Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2016-4861 EUVD-2022-5773GHSA-xfjq-w3cw-h5fq

Zend Framework Allows SQL Injection

Published Feb 16, 2017 · Updated Aug 6, 2024 · Assigned by jpcert

Package: zend-framework Package: zendframework/zendframework Ecosystem: Packagist Ecosystem: Ubuntu

Description

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 8 zendframework 1.12.9+dfsg-2+deb8u7 DLA-1403-1
Debian 7 zendframework 1.11.13-1.1+deb7u5 DLA-646-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS zend-framework No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist zendframework/zendframework < 1.12.20 1.12.20 GHSA-xfjq-w3cw-h5fq

Advisories 2

References