---
title: "GHSA-v42g-7q2x-cw32: Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)"
url: https://erroneo.us/security/ghsa/GHSA-v42g-7q2x-cw32/
description: "GHSA-v42g-7q2x-cw32 (critical, Composer (PHP)): Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite). The PDO adapters of…"
type: advisory
section: "Security Digest"
date_published: 2024-06-07
date_modified: 2024-06-07
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-v42g-7q2x-cw32"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-v42g-7q2x-cw32: Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)

## Affected packages

- Composer (PHP) `zendframework/zendframework1` >= 1.12.0, < 1.12.16 → fixed: 1.12.16

## Details

The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection. We tested and verified the null byte injection using pdodblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdosqlite.

## Sources

- [GitHub Advisory GHSA-v42g-7q2x-cw32](https://github.com/advisories/GHSA-v42g-7q2x-cw32)
- [framework.zend.com](https://framework.zend.com/security/advisory/ZF2015-08)
- [github.com](https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-08.yaml)

---
Source page: https://erroneo.us/security/ghsa/GHSA-v42g-7q2x-cw32/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt