CVE-2016-4861
CriticalSummary
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.
Risk Assessment
An attacker could exploit this vulnerability to manipulate SQL queries, potentially leading to unauthorized access to or modification of data.
Recommendation
It is recommended to upgrade Zend Framework to version 1.12.20 or later to mitigate this vulnerability.
Other vulnerabilities in Zend Framework
See all- CVE-2020-29312Critical
An issue found in Zend Framework v.3.1.3 and before allows a remote attacker to execute arbitrary code via the unserialize function. However, this has been disputed by third parties as incomplete and incorrect, and the framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
- CVE-2014-4914Critical
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.
- CVE-2015-1555Critical
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9 and 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
- CVE-2016-6233Critical
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.
- CVE-2015-7695Critical
The PDO adapters in Zend Framework before 1.12.16 do not filter null bytes in SQL statements, allowing remote attackers to execute arbitrary SQL commands via a crafted query.
Original NVD description (English source)
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.