CVE-2016-4861

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

Score

CVSS 3.0 9.8 Critical

Status

Modified - vultures@jpcert.or.jp

Published

2017-02-17

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• Fedora (Fedoraproject)
• Zend Framework (Zend)

References

• http://jvn.jp/en/jp/JVN18926672/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158
• https://framework.zend.com/security/advisory/ZF2016-03
• https://lists.debian.org/debian-lts-announce/2018/06/msg00012.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCL…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBE…
• https://security.gentoo.org/glsa/201804-10