PT-2019-7160 · Zend · Zend Framework

Grigory Ivanov · Published 2019-10-25 · Updated 2022-05-24 · CVE-2015-0270

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zend Framework versions 2.2.x through 2.2.9 Zend Framework versions 2.3.x through 2.3.4

Description The issue is related to a potential SQL injection in the PostgreSQL ZendDb adapter.

Recommendations For versions 2.2.x through 2.2.9, update to version 2.2.10 or later. For versions 2.3.x through 2.3.4, update to version 2.3.5 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-0270

GHSA-V59P-P692-V382

Affected Products

Zend Framework

References · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-0270.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2015-0270.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-v59p-p692-v382 · Vendor Advisory
• https://framework.zend.com/security/advisory/ZF2015-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0270 · Security Note
• https://github.com/zendframework/zendframework/commit/569f18228f5fc84534af6ff2f367ca1a7143ec65 · Note
• https://github.com/zendframework/zendframework · Note
• https://t.me/cibsecurity/7667 · Telegram Post