PT-2017-8558 · Zend · Zend Framework

Hiroshi Tokumaru

+1

·

Publicado

2016-10-21

·

Atualizado

2022-05-14

·

CVE-2016-4861

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 1.12.20
Description The issue concerns the order and group methods in Zend Db Select, which might allow remote attackers to conduct SQL injection attacks. This is due to the failure to remove comments from an SQL statement before validation.
Recommendations For versions prior to 1.12.20, update to version 1.12.20 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user input to minimize the risk of SQL injection attacks. Restrict access to the Zend Db Select component to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2016-4861
DLA-1403-1
DLA-646-1
GHSA-XFJQ-W3CW-H5FQ
MGASA-2016-0352

Produtos afetados

Zend Framework