Zend Framework SQL injection vector using null byte for PDO

CRITICAL 9.8CVE-2015-7695 · GHSA-2hvh-c5c2-vj85 · Published 07/06/2016 · updated 17/06/2026

In short

CVE-2015-7695 is a CRITICAL (CVSS 9.8) vulnerability affecting zendframework/zendframework1, zend framework (zend).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 86.9% of all vulnerabilities.
Fix: update to 1.12.16 or later.

Package	Affected versions	Patched versions
zendframework/zendframework1 Packagist	`< 1.12.16`	`1.12.16`
zend framework zend	`≤ 1.12.15`	No fix yet

Description

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

NVD description

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

References

nvd.nist.gov/vuln/detail/CVE-2015-7695 · ADVISORY
zendframework/zf1 · PACKAGE
framework.zend.com/security/advisory/ZF2015-08 · WEB
debian.org/security/2015/dsa-3369 · WEB
openwall.com/lists/oss-security/2015/09/30/6 · WEB
openwall.com/lists/oss-security/2015/09/30/8 · WEB
openwall.com/lists/oss-security/2015/10/11/3 · WEB
securityfocus.com/bid/76784 · WEB

More vulnerabilities in zendframework/zendframework1

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

zendframework/zendframework1

Packagist

< 1.12.16

1.12.16

zend framework

zend

≤ 1.12.15

No fix yet

Description

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

NVD description

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

More vulnerabilities in zendframework/zendframework1

See all →