GitHub Advisoryadvisory · Packagist

GHSA-qh9w-r7g5-q939 Zend Framework SQL injection vulnerability

CRITICAL Published 2024-04-23 Modified 2024-04-23 Official page ↗
Aliases
CVE-2014-8089
Ecosystem
Packagist
Packages
zendframework/zendframework1, zendframework/zend-db, zendframework/zendframework
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-04-23

Affected packages

• Packagist zendframework/zendframework1: >= 1.12.0, < 1.12.9 → fixed in 1.12.9 • Packagist zendframework/zend-db: >= 2.0.0, < 2.0.99 → fixed in 2.0.99 • Packagist zendframework/zend-db: >= 2.1.0, < 2.1.99 → fixed in 2.1.99 • Packagist zendframework/zend-db: >= 2.2.0, < 2.2.8 → fixed in 2.2.8 • Packagist zendframework/zend-db: >= 2.3.0, < 2.3.3 → fixed in 2.3.3 • Packagist zendframework/zendframework: >= 2.0.0, < 2.0.99 → fixed in 2.0.99 • Packagist zendframework/zendframework: >= 2.1.0, < 2.1.99 → fixed in 2.1.99 • Packagist zendframework/zendframework: >= 2.2.0, < 2.2.8 → fixed in 2.2.8 • Packagist zendframework/zendframework: >= 2.3.0, < 2.3.3 → fixed in 2.3.3

Description

SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

Related

Alias · CVE (1)

  • CVE-2014-8089 SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References