CVE-2016-6233

Critical

Published: 17/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.

Risk Assessment

An attacker may gain access to sensitive data in the database, potentially leading to serious security breaches for the organization.

Recommendation

It is recommended to update Zend Framework to version 1.12.19 or later to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.