PT-2016-3826 · Zend · Zend Framework

Alessandro Ghedini · Published 2015-10-06 · Updated 2022-05-17 · CVE-2015-7695

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 1.12.16

Description The issue allows remote attackers to execute arbitrary SQL commands via a crafted query, due to the failure of the PDO adapters to filter null bytes in SQL statements.

Recommendations For versions prior to 1.12.16, update to version 1.12.16 or later to resolve the issue.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-7695

DLA-326-1

DSA-3369-1

GHSA-2HVH-C5C2-VJ85

Affected Products

Zend Framework

References · 20

• https://ubuntu.com/security/CVE-2015-7695 · Vendor Advisory
• http://debian.org/security/2015/dsa-3369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7695 · Security Note
• https://security-tracker.debian.org/tracker/source-package/zendframework · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7695 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hvh-c5c2-vj85 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723 · Security Note
• https://osv.dev/vulnerability/DSA-3369-1 · Vendor Advisory
• http://framework.zend.com/security/advisory/ZF2015-08 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-7695 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3369-1 · Vendor Advisory
• https://github.com/zendframework/zf1 · Note
• https://github.com/zendframework/zf1/commit/2ac9c30f73ec2e6235c602bed745749a551b4fe2 · Note
• https://packages.debian.org/src:zendframework · Note