CVE-2015-7695
CriticalSummary
The PDO adapters in Zend Framework before 1.12.16 do not filter null bytes in SQL statements, allowing remote attackers to execute arbitrary SQL commands via a crafted query.
Risk Assessment
This vulnerability may lead to unauthorized access to the database and execution of malicious operations, threatening the integrity and confidentiality of organizational data.
Recommendation
It is recommended to upgrade Zend Framework to version 1.12.16 or later to mitigate this vulnerability.
Other vulnerabilities in Zend Framework
See all- CVE-2020-29312Critical
An issue found in Zend Framework v.3.1.3 and before allows a remote attacker to execute arbitrary code via the unserialize function. However, this has been disputed by third parties as incomplete and incorrect, and the framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
- CVE-2014-4914Critical
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.
- CVE-2015-1555Critical
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9 and 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
- CVE-2016-6233Critical
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.
- CVE-2016-4861Critical
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.
Original NVD description (English source)
The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.