CVE-2016-4861: Zend Framework Allows SQL Injection
The (1) order and (2) group methods in ZendDbSelect in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/zendframework/zendframeworkto a version that resolves this vulnerability.Fixed in 1.12.20 - Upgrade
Upgrade
Zend Frameworkto a version that resolves this vulnerability.Fixed in 1.12.20
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4861?
CVE-2016-4861 has a medium severity level due to its potential for SQL injection attacks.
How do I fix CVE-2016-4861?
To mitigate CVE-2016-4861, upgrade the Zend Framework to version 1.12.20 or newer.
What causes the vulnerability in CVE-2016-4861?
CVE-2016-4861 is caused by inadequate removal of comments from SQL statements in the order and group methods of Zend_Db_Select.
Which software versions are affected by CVE-2016-4861?
CVE-2016-4861 affects Zend Framework versions prior to 1.12.20 and specific Fedora versions 23, 24, and 25.
Who is impacted by CVE-2016-4861?
Developers and applications using vulnerable versions of Zend Framework are at risk from CVE-2016-4861.