p PatchFirst

PatchFirst · Latest vulnerabilities

zendframework/zendframework1 1.12.18: known vulnerabilities

Known vulnerabilities affecting zendframework/zendframework1 1.12.18: 2. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. GHSA-6fqw-j3vm-7f66

    Critical · CVSS 9.8Fix available

    Zendframework1 Potential SQL injection in ORDER and GROUP functions

    The implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur. The implementation of ORDER BY and GROUP BY in Zend_Db_Select of ZF1 is vulnerable by the following SQL injection: ``` $db = Zend_Db::factory(/* options here */); $select = new Zend_Db_Select($db); $select->from('p'); $select->order("MD5(\"a(\");DELETE FROM p2; #)"); // same with group() ``` The above $select will render th

    zendframework/zendframework1PHP
    • Update to 1.12.20
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →