CVE-2016-4861

Critical

Published: 17/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.

Risk Assessment

An attacker could exploit this vulnerability to manipulate SQL queries, potentially leading to unauthorized access to or modification of data.

Recommendation

It is recommended to upgrade Zend Framework to version 1.12.20 or later to mitigate this vulnerability.

Original NVD description (English source)

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.