GHSA-v42g-7q2x-cw32 Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
Attackers can inject arbitrary SQL via null bytes in PDO queries, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v42g-7q2x-cw32?
GHSA-v42g-7q2x-cw32 is a SQL injection vulnerability in zendframework/zendframework1, published on 7 Jun 2024. It can be exploited over the network, with no action from the victim.
Official description
The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.
We tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.
Which versions are affected by GHSA-v42g-7q2x-cw32?
2 open source packages ship an affected version, including zendframework/zendframework1.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zendframework1 Packagist | From 1.12.0 | 1.12.16 |
zendframework/zendframework1 Packagist | From 1.12.0 | 1.12.16 |
How do I fix GHSA-v42g-7q2x-cw32?
Upgrade zendframework/zendframework1 to 1.12.16 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-v42g-7q2x-cw32 being exploited?
There is no known exploitation of GHSA-v42g-7q2x-cw32 in the wild and no public exploit code.