CVE-2014-8089 Zend Framework SQL injection vulnerability
CriticalCVSS 9.8
EPSS 2.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zendframework1(Packagist) | >= 1.12.0, < 1.12.9 | 1.12.9 |
| zendframework/zendframework1(Packagist) | = 1.12.0 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.1 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.2 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.3 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.4 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.5 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.6 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.7 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.8 | No fix listed |
| zendframework/zend-db(Packagist) | >= 2.0.0, < 2.0.99 | 2.0.99 |
| zendframework/zend-db(Packagist) | = 2.0.3 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.0.4 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.0.5 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.0.6 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.0.7 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.0.8 | No fix listed |
| zendframework/zend-db(Packagist) | >= 2.1.0, < 2.1.99 | 2.1.99 |
| zendframework/zend-db(Packagist) | = 2.1.0 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.1.1 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.1.2 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.1.3 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.1.4 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.1.5 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.1.6 | No fix listed |
Show 52 more
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zend-db(Packagist) | >= 2.2.0, < 2.2.8 | 2.2.8 |
| zendframework/zend-db(Packagist) | = 2.2.0 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.2.1 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.2.2 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.2.3 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.2.4 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.2.5 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.2.6 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.2.7 | No fix listed |
| zendframework/zend-db(Packagist) | >= 2.3.0, < 2.3.3 | 2.3.3 |
| zendframework/zend-db(Packagist) | = 2.3.0 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.3.1 | No fix listed |
| zendframework/zend-db(Packagist) | = 2.3.2 | No fix listed |
| zendframework/zendframework(Packagist) | >= 2.0.0, < 2.0.99 | 2.0.99 |
| zendframework/zendframework(Packagist) | = 2.0.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.7 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.8 | No fix listed |
| zendframework/zendframework(Packagist) | >= 2.1.0, < 2.1.99 | 2.1.99 |
| zendframework/zendframework(Packagist) | = 2.1.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.6 | No fix listed |
| zendframework/zendframework(Packagist) | >= 2.2.0, < 2.2.8 | 2.2.8 |
| zendframework/zendframework(Packagist) | = 2.2.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.7 | No fix listed |
| zendframework/zendframework(Packagist) | >= 2.3.0, < 2.3.3 | 2.3.3 |
| zendframework/zendframework(Packagist) | = 2.3.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.2 | No fix listed |
| zend framework | < 1.12.9 | 1.12.9 |
| zend framework | >= 2.2.0, < 2.2.8 | 2.2.8 |
| zend framework | >= 2.3.0, < 2.3.3 | 2.3.3 |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- framework.zend.com
- github.com exploit
- github.com exploit
- github.com exploit
- framework.zend.com exploit vendor-advisory
- seclists.org mailing-list third-party-advisory
- 70011 third-party-advisory vdb-entry
- github.com