CVE-2016-4861 Zend Framework Allows SQL Injection
CriticalCVSS 9.8
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zendframework(Packagist) | < 1.12.20 | 1.12.20 |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| fedoraproject fedora | = 25 | No fix listed |
| zend framework | <= 1.12.19 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- framework.zend.com exploit technical-description vendor-advisory
- github.com product
- [debian-lts-announce] 20180628 [SECURITY] [DLA 1403-1] zendframework security update mailing-list
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- GLSA-201804-10 vendor-advisory
- JVN#18926672 third-party-advisory vdb-entry
- JVNDB-2016-000158 third-party-advisory vdb-entry
- github.com
- FEDORA-2016-7f193a0c59 vendor-advisory
- FEDORA-2016-77e5105570 vendor-advisory
- FEDORA-2016-666d95d1d5 vendor-advisory