Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
The advisory, in context
The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.
We tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 1.12.0 before 1.12.16
Fixed in 1.12.16
16 explicitly affected versions
1.12.0, 1.12.1, 1.12.10, 1.12.11, 1.12.12, 1.12.13, 1.12.14, 1.12.15, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.12.6, 1.12.7, 1.12.8, 1.12.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.16"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.12.0",
"1.12.1",
"1.12.10",
"1.12.11",
"1.12.12",
"1.12.13",
"1.12.14",
"1.12.15",
"1.12.2",
"1.12.3",
"1.12.4",
"1.12.5",
"1.12.6",
"1.12.7",
"1.12.8",
"1.12.9"
]
}