GHSA-2x36-qhx3-7m5f

Suggest an improvement
Source
https://github.com/advisories/GHSA-2x36-qhx3-7m5f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-2x36-qhx3-7m5f/GHSA-2x36-qhx3-7m5f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2x36-qhx3-7m5f
Published
2024-06-07T22:24:52Z
Modified
2024-06-07T22:30:44.274910Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
Details

The implementation of the ORDER BY SQL statement in ZendDbSelect of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.

For instance, the following code is affected by this issue:

$db     = Zend_Db::factory( /* options here */ );
$select = $db->select()
    ->from(array('p' => 'products'))
    ->order('MD5(1); drop table products');
echo $select;

This code produce the string:

SELECT "p".* FROM "products" AS "p" ORDER BY MD5(1);drop table products ASC

instead of the correct one:

SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);drop table products" ASC

The SQL injection occurs because we create a new ZendDbExpr() object, in presence of parentheses, passing directly the value without any filter on the string.

References

Affected packages

Packagist / zendframework/zendframework1

Package

Name
zendframework/zendframework1
Purl
pkg:composer/zendframework/zendframework1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.12.0
Fixed
1.12.7

Affected versions

1.*

1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6