CVE-2016-6233 Zend Framework Allows SQL Injection
Remote attackers can execute SQL injection attacks via the order and group methods in Zend_Db_Select, potentially compromising database integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6233?
CVE-2016-6233 is a critical SQL injection vulnerability in Fedoraproject Fedora, published on 16 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.
Weakness: CWE-89
Which versions are affected by CVE-2016-6233?
4 open source packages ship an affected version, including zendframework/zendframework and zendframework/zendframework1. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zendframework Packagist | All versions | 1.12.19 |
zendframework/zendframework Packagist | All versions | 1.12.19 |
zendframework/zendframework1 Packagist | All versions | 1.12.19 |
zendframework/zendframework1 Packagist | All versions | 1.12.19 |
Products include Fedoraproject Fedora, Zend Zend Framework.
How do I fix CVE-2016-6233?
Upgrade zendframework/zendframework to 1.12.19 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2016-6233 being exploited?
There is no known exploitation of CVE-2016-6233 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-p9hp-3gpv-52w3, MGASA-2016-0272, UBUNTU-CVE-2016-6233.