CVE-2014-4914 The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
CriticalCVSS 9.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zend framework | < 1.12.7 | 1.12.7 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- framework.zend.com vendor-advisory
- JVN#71730320 third-party-advisory vdb-entry
- [oss-security] 20140711 Re: Zend Framework CVEs mailing-list third-party-advisory
- 58847 third-party-advisory
- 68031 third-party-advisory vdb-entry
- DSA-3265 third-party-advisory vendor-advisory