---
title: "GHSA-6fqw-j3vm-7f66: Zendframework1 Potential SQL injection in ORDER and GROUP functions"
url: https://erroneo.us/security/ghsa/GHSA-6fqw-j3vm-7f66/
description: "GHSA-6fqw-j3vm-7f66 (critical, Composer (PHP)): Zendframework1 Potential SQL injection in ORDER and GROUP functions. The implementation of ORDER BY and…"
type: advisory
section: "Security Digest"
date_published: 2024-06-07
date_modified: 2024-06-07
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-6fqw-j3vm-7f66"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-6fqw-j3vm-7f66: Zendframework1 Potential SQL injection in ORDER and GROUP functions

## Affected packages

- Composer (PHP) `zendframework/zendframework1` < 1.12.20 → fixed: 1.12.20

## Details

The implementation of ORDER BY and GROUP BY in ZendDbSelect remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur. The implementation of ORDER BY and GROUP BY in ZendDbSelect of ZF1 is vulnerable by the following SQL injection: The above $select will render the following SQL statement: instead of the correct one: This security fix can be considered an improvement of the previous ZF2016-02 and ZF2014-04 advisories. As a final consideration, we recommend developers either never use user input for these operations, or filter user input thoroughly prior to invoking ZendDb. You can use the ZendDbSelect::quoteInto() method to filter the input data, as shown in this example:

## Sources

- [GitHub Advisory GHSA-6fqw-j3vm-7f66](https://github.com/advisories/GHSA-6fqw-j3vm-7f66)
- [framework.zend.com](https://framework.zend.com/security/advisory/ZF2016-03)
- [github.com](https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-03.yaml)

---
Source page: https://erroneo.us/security/ghsa/GHSA-6fqw-j3vm-7f66/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt