GHSA-qf36-fx9f-232x ZendFramework potential SQL Injection Vector When Using PDO_MySql
SQL injection possible in Zend Framework when using non-ASCII-compatible encodings with PDO_MySql, allowing attackers to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-qf36-fx9f-232x?
GHSA-qf36-fx9f-232x is a SQL injection vulnerability in zendframework/zendframework1, published on 7 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:
http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on.
Which versions are affected by GHSA-qf36-fx9f-232x?
4 open source packages ship an affected version, including zendframework/zendframework1.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zendframework1 Packagist | From 1.10.0 | 1.10.9 |
zendframework/zendframework1 Packagist | From 1.10.0 | 1.10.9 |
zendframework/zendframework1 Packagist | From 1.11.0 | 1.11.6 |
zendframework/zendframework1 Packagist | From 1.11.0 | 1.11.6 |
How do I fix GHSA-qf36-fx9f-232x?
Upgrade zendframework/zendframework1 to a fixed version for your release line: 1.10.9 or 1.11.6.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-qf36-fx9f-232x being exploited?
There is no known exploitation of GHSA-qf36-fx9f-232x in the wild and no public exploit code.