PT-2019-6635 · Zend+1 · Zend Framework+2

Anthony Ferrara · Publicado 2019-11-26 · Atualizado 2019-12-10 · CVE-2011-1939

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework versions 1.10.x through 1.10.8 Zend Framework versions 1.11.x through 1.11.5 PHP versions prior to 5.3.6

Description The issue is related to a SQL injection vulnerability when using non-ASCII-compatible encodings in conjunction with PDO MySql. This vulnerability can be exploited when the Zend Framework is used with PHP.

Recommendations For Zend Framework versions 1.10.x through 1.10.8, update to version 1.10.9 or later. For Zend Framework versions 1.11.x through 1.11.5, update to version 1.11.6 or later. For PHP versions prior to 5.3.6, update to version 5.3.6 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2011-1939

Produtos afetados

Pdo Mysql

Php

Zend Framework

Referências · 11

• 🔥 https://bugs.php.net/bug.php?id=47802 · Exploit
• 🔥 https://exploit-db.com/exploits/35784 · Exploit
• https://framework.zend.com/security/advisory/ZF2011-02 · Aviso do Fabricante
• https://t.me/cibsecurity/8349 · Publicação no Telegram
• https://access.redhat.com/security/cve/cve-2011-1939 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1939 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1939 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-201408-01.xml · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1939 · Nota
• http://securityfocus.com/bid/47919 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-1939 · Aviso do Fabricante