CVE-2015-7695

Critical

Published: 07/06/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The PDO adapters in Zend Framework before 1.12.16 do not filter null bytes in SQL statements, allowing remote attackers to execute arbitrary SQL commands via a crafted query.

Risk Assessment

This vulnerability may lead to unauthorized access to the database and execution of malicious operations, threatening the integrity and confidentiality of organizational data.

Recommendation

It is recommended to upgrade Zend Framework to version 1.12.16 or later to mitigate this vulnerability.

Original NVD description (English source)

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.