GHSA-2x36-qhx3-7m5fcritical9.8
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
No CVE assignedCheck your stack
The advisory, in context
The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.
For instance, the following code is affected by this issue:
$db = Zend_Db::factory( /* options here */ );
$select = $db->select()
->from(array('p' => 'products'))
->order('MD5(1); drop table products');
echo $select;
This code produce the string:
SELECT "p".* FROM "products" AS "p" ORDER BY MD5(1);drop table products ASC
instead of the correct one:
SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);drop table products" ASC
The SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
zendframework/zendframework1 Packagist
Ecosystem versions
From 1.12.0 before 1.12.7
Fixed in 1.12.7
7 explicitly affected versions
1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.12.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.12.0",
"1.12.1",
"1.12.2",
"1.12.3",
"1.12.4",
"1.12.5",
"1.12.6"
]
}