NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

GHSA-2x36-qhx3-7m5f: ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select

criticalCVSS 3.1 9.8

The implementation of the ORDER BY SQL statement in ZendDbSelect of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses. For instance, the following code is affected by this issue: This code produce the string: instead of the correct one: The SQL injection occurs because we create a new ZendDbExpr() object, in presence of parentheses, passing directly the value…

Published Jun 7, 2024

Affected packages

zendframework/zendframework1

Ecosystem
Composer (PHP)
Affected
>= 1.12.0, < 1.12.7
Fixed in
1.12.7
Check
composer show zendframework/zendframework1

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.

For instance, the following code is affected by this issue:

$db     = Zend_Db::factory( /* options here */ );
$select = $db->select()
    ->from(array('p' => 'products'))
    ->order('MD5(1); drop table products');
echo $select;

This code produce the string:

SELECT "p".* FROM "products" AS "p" ORDER BY MD5(1);drop table products ASC

instead of the correct one:

SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);drop table products" ASC

The SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries