NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

GHSA-qf36-fx9f-232x: ZendFramework potential SQL Injection Vector When Using PDO_MySql

criticalCVSS 3.1 9.8

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here: http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed…

Published Jun 7, 2024

Affected packages

zendframework/zendframework1

Ecosystem
Composer (PHP)
Affected
>= 1.10.0, < 1.10.9
Fixed in
1.10.9
Check
composer show zendframework/zendframework1

zendframework/zendframework1

Ecosystem
Composer (PHP)
Affected
>= 1.11.0, < 1.11.6
Fixed in
1.11.6
Check
composer show zendframework/zendframework1

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:

http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries