GHSA-2x36-qhx3-7m5f

Source

https://github.com/advisories/GHSA-2x36-qhx3-7m5f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-2x36-qhx3-7m5f/GHSA-2x36-qhx3-7m5f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2x36-qhx3-7m5f

Published

2024-06-07T22:24:52Z

Modified

2024-12-04T05:39:35.461646Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select

Details

The implementation of the ORDER BY SQL statement in ZendDbSelect of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.

For instance, the following code is affected by this issue:

$db     = Zend_Db::factory( /* options here */ );
$select = $db->select()
    ->from(array('p' => 'products'))
    ->order('MD5(1); drop table products');
echo $select;

This code produce the string:

SELECT "p".* FROM "products" AS "p" ORDER BY MD5(1);drop table products ASC

instead of the correct one:

SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);drop table products" ASC

The SQL injection occurs because we create a new ZendDbExpr() object, in presence of parentheses, passing directly the value without any filter on the string.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-07T22:24:52Z"
}

References

Affected packages

Packagist / zendframework/zendframework1

Package

Name: zendframework/zendframework1
Purl: pkg:composer/zendframework/zendframework1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.12.0

Fixed

1.12.7

Affected versions

1.*

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6