Zend Framework Allows SQL Injection
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-4861US | critical9.8 | Exploit | ||
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to re… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://jvn.jp/en/jp/JVN18926672/index.htmlWEB
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158WEB
- https://framework.zend.com/security/advisory/ZF2016-03WEB
- https://github.com/zendframework/zendframeworkPACKAGE
- https://lists.debian.org/debian-lts-announce/2018/06/msg00012.htmlWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTUWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTITWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan