CVE-2015-7695: Zend Framework SQL injection vector using null byte for PDO
The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
Other sources
Zend Framework SQL injection vector using null byte for PDO
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/zendframework/zendframework1to a version that resolves this vulnerability.Fixed in 1.12.16
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7695?
CVE-2015-7695 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2015-7695?
To fix CVE-2015-7695, you should upgrade to version 1.12.16 or later of the Zend Framework.
Which versions of Zend Framework are affected by CVE-2015-7695?
CVE-2015-7695 affects all versions of Zend Framework prior to 1.12.16.
Can CVE-2015-7695 be exploited remotely?
Yes, CVE-2015-7695 can be exploited remotely by attackers with crafted SQL queries.
What vulnerabilities does CVE-2015-7695 introduce?
CVE-2015-7695 introduces risks of SQL injection attacks due to the failure to filter null bytes in SQL statements.