Published: 29/12/2017 Updated: 17/01/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Zend_Db_Select::order function in Zend Framework prior to 1.12.7 does not properly handle parentheses, which allows remote malicious users to conduct SQL injection attacks via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
zend zend framework
debian debian linux 7.0
debian debian linux 8.0

Debian Bug report logs - #754201 Potential SQL injection in the ORDER implementation of Zend_Db_Select (ZF2014-04) Package: zendframework; Maintainer for zendframework is Debian PHP PEAR Maintainers <pkg-php-pear@listsaliothdebianorg>; Source for zendframework is src:zendframework (PTS, buildd, popcon) Reported by: David ...

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework Except for CVE-2015-3154, all these issues were already fixed in the version initially shipped with Jessie CVE-2014-2681 Lukas Reschke reported a lack of protection against XML External Entity injection attacks in some functions This fix extends the incomple ...

The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses, as discussed in <a href="frameworkzendcom/security/advisory/ZF2014-04">frameworkzendcom/security/advisory/ZF2014-04</a> ...

CWE-89 http://www.securityfocus.com/bid/68031 http://secunia.com/advisories/58847 http://openwall.com/lists/oss-security/2014/07/11/4 http://jvn.jp/en/jp/JVN71730320/index.html http://framework.zend.com/security/advisory/ZF2014-04 https://www.debian.org/security/2015/dsa-3265 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754201 https://www.debian.org/security/./dsa-3265

CVE-2014-4914

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect