CVE-2014-8089: Zend Framework SQL injection vulnerability
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
Published Apr 23, 2024
Affected packages
zendframework/zendframework1
- Ecosystem
- Composer (PHP)
- Affected
- >= 1.12.0, < 1.12.9
- Fixed in
- 1.12.9
- Check
composer show zendframework/zendframework1
zendframework/zend-db
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.0.0, < 2.0.99
- Fixed in
- 2.0.99
- Check
composer show zendframework/zend-db
zendframework/zend-db
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.1.0, < 2.1.99
- Fixed in
- 2.1.99
- Check
composer show zendframework/zend-db
zendframework/zend-db
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.2.0, < 2.2.8
- Fixed in
- 2.2.8
- Check
composer show zendframework/zend-db
zendframework/zend-db
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.3.0, < 2.3.3
- Fixed in
- 2.3.3
- Check
composer show zendframework/zend-db
zendframework/zendframework
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.0.0, < 2.0.99
- Fixed in
- 2.0.99
- Check
composer show zendframework/zendframework
zendframework/zendframework
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.1.0, < 2.1.99
- Fixed in
- 2.1.99
- Check
composer show zendframework/zendframework
zendframework/zendframework
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.2.0, < 2.2.8
- Fixed in
- 2.2.8
- Check
composer show zendframework/zendframework
zendframework/zendframework
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.3.0, < 2.3.3
- Fixed in
- 2.3.3
- Check
composer show zendframework/zendframework
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-8089
- https://bugzilla.redhat.com/show_bug.cgi?id=1151277
- https://framework.zend.com/security/advisory/ZF2014-06
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml
- https://github.com/advisories/GHSA-qh9w-r7g5-q939
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesGHSA-2x36-qhx3-7m5f
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
critical9.8Jun 7, 2024GHSA-6fqw-j3vm-7f66
Zendframework1 Potential SQL injection in ORDER and GROUP functions
critical9.8Jun 7, 2024GHSA-mhpx-3rv8-wrjm
ZendFramework potential XML eXternal Entity injection vectors
critical9.8Jun 7, 2024GHSA-qc7w-4567-84wv
Zendframework vulnerable to XXE/XEE attacks
critical9.8Jun 7, 2024GHSA-qf36-fx9f-232x
ZendFramework potential SQL Injection Vector When Using PDO_MySql
critical9.8Jun 7, 2024GHSA-v42g-7q2x-cw32
Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
critical9.8Jun 7, 2024