ZendFramework1: Potential SQL Injection Vector When Using PDO_MySql
Summary
GHSA-qf36-fx9f-232x: ZendFramework potential SQL Injection Vector When Using PDO_MySql. Affects zendframework/zendframework1 across 2 version ranges.
>= 1.10.0, < 1.10.9
>= 1.11.0, < 1.11.6
Fixed in 1.10.9 or 1.11.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZendFramework1 is a popular PHP framework used for developing web applications. It provides a set of libraries and components that simplify the development process. One of the components, PDO_MySql, is used for connecting to MySQL databases. However, developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver may be vulnerable to SQL injection attacks. This vulnerability affects versions 1.10.0 to 1.10.9 and 1.11.0 to 1.11.6 of ZendFramework1.
Vulnerability Detail
The vulnerability arises due to a PHP issue (bug #47802) related to character set information passed as part of the DSN in PDO. Developers using non-ASCII-compatible encodings are affected, while those using ASCII-compatible encodings like UTF8 or latin1 are not. The issue allows an attacker to perform SQL injection attacks by manipulating the character set information. This can lead to unauthorized access, data leakage, or modification of the database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.10.0, < 1.10.91.10.9composer require zendframework/zendframework1:1.10.9 -
>= 1.11.0, < 1.11.61.11.6composer require zendframework/zendframework1:1.11.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can enforce the use of ASCII-compatible encodings like UTF8 or latin1. This can be done by configuring the database and PHP to use these encodings. Additionally, input validation and parameterized queries should be implemented to mitigate the risk of SQL injection attacks.
Conclusion
The vulnerability in ZendFramework1 allows for SQL injection attacks when using non-ASCII-compatible encodings with the MySQL PDO driver. Upgrading to the fixed versions and implementing proper input validation and parameterized queries can mitigate the risk. It is important to stay updated with security patches and follow best practices to ensure the security of web applications.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
Versions 1.10.0 to 1.10.9 and 1.11.0 to 1.11.6 of ZendFramework1 are affected.
The vulnerability allows attackers to perform SQL injection attacks, potentially leading to unauthorized access, data leakage, or modification of the database.
Yes, developers can enforce the use of ASCII-compatible encodings like UTF8 or latin1 and implement input validation and parameterized queries.
To fix this vulnerability, upgrade ZendFramework1 to version 1.10.9 or 1.11.6 and ensure proper validation and sanitization of character set information.
Yes, the CVSS score for this vulnerability is 9.8 (Critical).
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
