The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

Versions of Zend Framework earlier than 1.12.16 contain a flaw that may allow an SQL injection attack.  The issue is due to 'Zend_Db_Adapter_Pdo_Abstract' not properly sanitizing user-supplied input involving null bytes.  This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

The PDO adapters of Zend Framework 1 did not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.

For Debian 6 Squeeze, this issue has been fixed in zendframework version 1.10.6-1squeeze6.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Zend Framework developers report :

The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework :

  - CVE-2015-5723     It was discovered that due to incorrect permissions     masks when creating directories, local attackers could     potentially execute arbitrary code or escalate     privileges.

  - ZF2015-08 (no CVE assigned)

    Chris Kings-Lynne discovered a SQL injection vector     caused by missing null byte filtering in the MS SQL PDO     backend, and a similar issue was also found in the     SQLite backend.

ID	Name	Product	Family	Severity
9148	Zend Framework < 1.12.16 SQL Injection	Nessus Network Monitor	CGI	high
86406	Debian DLA-326-1 : zendframework security update	Nessus	Debian Local Security Checks	critical
86305	FreeBSD : ZendFramework1 -- SQL injection vulnerability (d3324fdb-6bf0-11e5-bc5e-00505699053e)	Nessus	FreeBSD Local Security Checks	critical
86303	Debian DSA-3369-1 : zendframework - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-7695

critical

Tenable Plugins

high

critical

critical

critical