PT-2017-8558 · Zend · Zend Framework

Hiroshi Tokumaru + 1 · Published 2016-10-21 · Updated 2022-05-14 · CVE-2016-4861

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 1.12.20

Description The issue concerns the order and group methods in Zend Db Select, which might allow remote attackers to conduct SQL injection attacks. This is due to the failure to remove comments from an SQL statement before validation.

Recommendations For versions prior to 1.12.20, update to version 1.12.20 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user input to minimize the risk of SQL injection attacks. Restrict access to the Zend Db Select component to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-4861

DLA-1403-1

DLA-646-1

GHSA-XFJQ-W3CW-H5FQ

MGASA-2016-0352

Affected Products

Zend Framework

References · 24

• 🔥 https://framework.zend.com/security/advisory/ZF2016-03 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-4861 · Security Note
• https://security.gentoo.org/glsa/201804-10 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4861 · Security Note
• https://advisories.mageia.org/MGASA-2016-0352.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4861 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4861 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xfjq-w3cw-h5fq · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0352 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4861 · Vendor Advisory