CVE-2014-4914
CriticalSummary
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.
Risk Assessment
This vulnerability may lead to unauthorized access to database data, posing a serious threat to the security of the application and the organization's data.
Recommendation
It is recommended to upgrade Zend Framework to version 1.12.7 or later to mitigate this vulnerability.
Other vulnerabilities in Zend Framework
See all- CVE-2020-29312Critical
An issue found in Zend Framework v.3.1.3 and before allows a remote attacker to execute arbitrary code via the unserialize function. However, this has been disputed by third parties as incomplete and incorrect, and the framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
- CVE-2015-1555Critical
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9 and 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
- CVE-2016-6233Critical
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.
- CVE-2016-4861Critical
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.
- CVE-2015-7695Critical
The PDO adapters in Zend Framework before 1.12.16 do not filter null bytes in SQL statements, allowing remote attackers to execute arbitrary SQL commands via a crafted query.
Original NVD description (English source)
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.