Critical SQL Injection Vulnerability in ZendFramework1: Potential Exploitation via ORDER Implementation
Summary
GHSA-2x36-qhx3-7m5f: ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select. Affects zendframework/zendframework1 versions >= 1.12.0, < 1.12.7. Fixed in 1.12.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework 1 is an open-source framework for developing web applications and services in PHP. It provides a robust architecture and a set of components that facilitate the development of secure and maintainable applications. However, it has been found to have a critical SQL injection vulnerability in its ORDER BY implementation within the Zend_Db_Select component, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability arises from the way the ORDER BY SQL statement is constructed in Zend_Db_Select. When a query string containing parentheses is passed, it can lead to a SQL injection. For example, if an attacker manipulates the order clause as follows: order('MD5(1); drop table products'), the resulting SQL query will execute the drop table command, allowing unauthorized data manipulation. This issue is due to the lack of proper filtering when creating a new Zend_Db_Expr() object, which directly incorporates user input without sanitization.
How To Fix
Minimum fixed version
1.12.7
This is the first release that contains the fix.
composer require zendframework/zendframework1:1.12.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user input directly in the ORDER BY clause. Instead, use predefined values or sanitize the input thoroughly before passing it to the order method. For example, you can implement a whitelist of acceptable order fields and validate user input against this list before constructing the query.
Conclusion
The SQL injection vulnerability in ZendFramework1's ORDER implementation poses a significant risk to applications using this framework. It is crucial to update to the patched version 1.12.7 or later to safeguard against potential exploits. Additionally, employing best practices for input validation can help mitigate risks until an update can be applied.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity that requires immediate attention.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary SQL commands, leading to data loss, corruption, or unauthorized access to sensitive information.
To prevent similar vulnerabilities, always validate and sanitize user inputs, and keep your dependencies updated to the latest secure versions.
If an immediate update is not possible, implement strict input validation and sanitization as a temporary measure to mitigate the risk of SQL injection.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
