---
title: "GHSA-2x36-qhx3-7m5f: ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select"
url: https://erroneo.us/security/ghsa/GHSA-2x36-qhx3-7m5f/
description: "GHSA-2x36-qhx3-7m5f (critical, Composer (PHP)): ZendFramework1 Potential SQL injection in the ORDER implementation of ZendDbSelect. The implementation of…"
type: advisory
section: "Security Digest"
date_published: 2024-06-07
date_modified: 2024-06-07
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2x36-qhx3-7m5f"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2x36-qhx3-7m5f: ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select

## Affected packages

- Composer (PHP) `zendframework/zendframework1` >= 1.12.0, < 1.12.7 → fixed: 1.12.7

## Details

The implementation of the ORDER BY SQL statement in ZendDbSelect of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses. For instance, the following code is affected by this issue: This code produce the string: instead of the correct one: The SQL injection occurs because we create a new ZendDbExpr() object, in presence of parentheses, passing directly the value without any filter on the string.

## Sources

- [GitHub Advisory GHSA-2x36-qhx3-7m5f](https://github.com/advisories/GHSA-2x36-qhx3-7m5f)
- [framework.zend.com](https://framework.zend.com/security/advisory/ZF2014-04)
- [github.com](https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-04.yaml)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2x36-qhx3-7m5f/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt