Security Digest · Critical advisory (no CVE assigned)
GHSA-6fqw-j3vm-7f66: Zendframework1 Potential SQL injection in ORDER and GROUP functions
The implementation of ORDER BY and GROUP BY in ZendDbSelect remained prone to SQL injection when a combination of SQL expressions and comments were used.
CVSS 9.8 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | zendframework/zendframework1 | < 1.12.20 | 1.12.20 |
Details
The implementation of ORDER BY and GROUP BY in ZendDbSelect remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur.
The implementation of ORDER BY and GROUP BY in ZendDbSelect of ZF1 is vulnerable by the following SQL injection:
The above $select will render the following SQL statement:
instead of the correct one:
This security fix can be considered an improvement of the previous ZF2016-02 and ZF2014-04 advisories.
As a final consideration, we recommend developers either never use user input for these operations, or filter user input thoroughly prior to invoking ZendDb. You can use the ZendDbSelect::quoteInto() method to filter the input data, as shown in this example:
CVSS: 9.8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-6fqw-j3vm-7f66 github.com
- framework.zend.com framework.zend.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest