PT-2024-40515 · Zend · Zend Framework 2

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zend Framework 2 (affected versions not specified)

Description The issue concerns the ZendDb component in Zend Framework 2, which provides platform abstraction for SQL. Specifically, the quoteValue() and quoteValueList() methods in the platform interface are flawed, potentially leading to SQL injection. These methods are used for debugging and logging purposes but can also be used to produce SQL statements that are executed by the driver. The flaw arises from the methods not properly escaping characters when creating quoted values for SQL strings, and not considering character-sets when quoting values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-X2F4-8WXF-W3VF

Affected Products

Zend Framework 2

References · 10

• https://osv.dev/vulnerability/GHSA-x2f4-8wxf-w3vf · Vendor Advisory
• https://github.com/zendframework/zendframework/commit/6d83777786b8e6171d82191ef917afd09fcb6601 · Note
• https://github.com/zendframework/zendframework/commit/0ef63e7db5fa30a79a58eb7c6466c6ab5c0618c5 · Note
• https://github.com/zendframework/zendframework/commit/546074660e6e10b9191bf0dc62b524d99f71a5cd · Note
• https://github.com/zendframework/zendframework/commit/d1f259b9d6dbd7c3828360afcfdd3658f2163ea0 · Note
• https://github.com/zendframework/zendframework/commit/870741d0c01a24ff23f9e209c8d393bd3a4115e3 · Note
• https://github.com/zendframework/zendframework/commit/95c88c236e80b475141d227bdf7866ca40287dd1 · Note
• https://github.com/zendframework/zendframework · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2013-03.yaml · Note
• https://framework.zend.com/security/advisory/ZF2013-03 · Note