CVE-2015-7695: SQL Injection
Published Jun 7, 2016
·Updated
The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
Affected Software
4 affected componentsFixes available
composer/zendframework/zendframework1<1.12.16
1.12.16
Zend Zend Framework<=1.12.15
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Event History
Jun 7, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·03:44 AM
Frequently Asked Questions
1
What is the severity of CVE-2015-7695?
CVE-2015-7695 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2015-7695?
To fix CVE-2015-7695, you should upgrade to version 1.12.16 or later of the Zend Framework.
3
Which versions of Zend Framework are affected by CVE-2015-7695?
CVE-2015-7695 affects all versions of Zend Framework prior to 1.12.16.
4
Can CVE-2015-7695 be exploited remotely?
Yes, CVE-2015-7695 can be exploited remotely by attackers with crafted SQL queries.
5
What vulnerabilities does CVE-2015-7695 introduce?
CVE-2015-7695 introduces risks of SQL injection attacks due to the failure to filter null bytes in SQL statements.