CVE-2014-4914

Critical

Published: 29/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.

Risk Assessment

This vulnerability may lead to unauthorized access to database data, posing a serious threat to the security of the application and the organization's data.

Recommendation

It is recommended to upgrade Zend Framework to version 1.12.7 or later to mitigate this vulnerability.

Original NVD description (English source)

The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.