CVE-2016-4861: SQL Injection
Published Feb 16, 2017
·Updated
The (1) order and (2) group methods in ZendDbSelect in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
Affected Software
5 affected componentsFixes available
composer/zendframework/zendframework<1.12.20
1.12.20
fedoraproject fedora=23
fedoraproject fedora=24
fedoraproject fedora=25
VMware Spring Framework<=1.12.19
Event History
Feb 16, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Feb 17, 2017
Data Sourced
via NVD·02:59 AM
DescriptionSeverityWeaknessAffected Software
May 14, 2022
Advisory Published
02:19 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-4861?
CVE-2016-4861 has a medium severity level due to its potential for SQL injection attacks.
2
How do I fix CVE-2016-4861?
To mitigate CVE-2016-4861, upgrade the Zend Framework to version 1.12.20 or newer.
3
What causes the vulnerability in CVE-2016-4861?
CVE-2016-4861 is caused by inadequate removal of comments from SQL statements in the order and group methods of Zend_Db_Select.
4
Which software versions are affected by CVE-2016-4861?
CVE-2016-4861 affects Zend Framework versions prior to 1.12.20 and specific Fedora versions 23, 24, and 25.
5
Who is impacted by CVE-2016-4861?
Developers and applications using vulnerable versions of Zend Framework are at risk from CVE-2016-4861.