SQL Injection Vulnerability in ZendFramework
Summary
GHSA-x2f4-8wxf-w3vf: ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations. Affects zendframework/zendframework across 2 version ranges.
>= 2.0.0, < 2.0.8
>= 2.1.0, < 2.1.4
Fixed in 2.0.8 or 2.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZendFramework is an open-source PHP framework that provides a platform for developing web applications. It includes the Zend\Db component, which offers platform abstraction for SQL operations. This vulnerability affects versions 2.0.0 to 2.0.8 and 2.1.0 to 2.1.4 of the zendframework/zendframework package.
Vulnerability Detail
The vulnerability arises from a flaw in the quoteValue() and quoteValueList() methods of the Zend\Db\Adapter\Platform* objects. These methods are used for manually quoting values in SQL statements, but they do not properly escape all characters that need to be escaped. Additionally, they do not coordinate with extension level character-sets when quoting. This can lead to SQL injection attacks, allowing malicious actors to execute arbitrary SQL statements.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.82.0.8composer require zendframework/zendframework:2.0.8 -
>= 2.1.0, < 2.1.42.1.4composer require zendframework/zendframework:2.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The SQL injection vulnerability in ZendFramework's Zend\Db component can lead to the execution of arbitrary SQL statements. It is crucial to upgrade to the fixed versions of the zendframework/zendframework package to mitigate this vulnerability.
See every vulnerability recorded for zendframework/zendframework →
FAQ
This vulnerability allows attackers to execute arbitrary SQL statements, potentially leading to unauthorized access, data manipulation, or data loss.
No, only versions 2.0.0 to 2.0.8 and 2.1.0 to 2.1.4 of the zendframework/zendframework package are affected.
Yes, upgrading to version 2.0.9 or later for versions 2.0.0 to 2.0.8, and upgrading to version 2.1.5 or later for versions 2.1.0 to 2.1.4 will fix the vulnerability.
No, there is no known workaround for this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and it will analyze the dependencies for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework.
