Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
Summary
GHSA-v42g-7q2x-cw32: Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite). Affects zendframework/zendframework1 versions >= 1.12.0, < 1.12.16. Fixed in 1.12.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.
We tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.
How To Fix
Minimum fixed version
1.12.16
This is the first release that contains the fix.
composer require zendframework/zendframework1:1.12.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
