CVE-2014-8089: SQL Injection
SQL injection vector when manually quoting values for sqlsrv extension, using null byte
Other sources
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
The 1.12.9, 2.2.8, and 2.3.3 releases of the Zend Framework fix an SQL injection issue when using the sqlsrv PHP extension. Full details are available in the upstream advisory.
For the php-ZendFramework packages (not php-ZendFramework2) in Fedora 19 and 20, the fixed version is already in the testing repositories.
References:
http://framework.zend.com/security/advisory/ZF2014-06 http://framework.zend.com/blog/zend-framework-1-12-9-2-2-8-and-2-3-3-released.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8089?
CVE-2014-8089 is categorized as a critical vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2014-8089?
To fix CVE-2014-8089, upgrade to Zend Framework versions 2.3.3, 2.2.8, 2.1.99, or 2.0.99, or to Zend Framework 1.12.9.
Which versions of Zend Framework are affected by CVE-2014-8089?
CVE-2014-8089 affects Zend Framework versions prior to 1.12.9, 2.2.8, 2.3.3, as well as specific versions of zend-db and zendframework1.
What type of vulnerability is CVE-2014-8089?
CVE-2014-8089 is an SQL injection vulnerability that arises when using the sqlsrv PHP extension in the Zend Framework.
Can CVE-2014-8089 be exploited remotely?
Yes, CVE-2014-8089 can be exploited remotely by attackers to gain unauthorized access to databases.