Zend Framework SQL injection vector using null byte for PDO

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-7695 · ADVISORY
• zendframework/zf1 · PACKAGE
• framework.zend.com/security/advisory/ZF2015-08 · WEB
• debian.org/security/2015/dsa-3369 · WEB
• openwall.com/lists/oss-security/2015/09/30/6 · WEB
• openwall.com/lists/oss-security/2015/09/30/8 · WEB
• openwall.com/lists/oss-security/2015/10/11/3 · WEB
• securityfocus.com/bid/76784 · WEB

zendframework/zendframework1 のその他の脆弱性

• GHSA-6fqw-j3vm-7f66緊急 9.8Zendframework1 Potential SQL injection in ORDER and GROUP functions
• GHSA-848f-mph5-9pm9高 7.5Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
• GHSA-8xhv-gqm4-3w99高 7.5ZendFramework1 Potential Insufficient Entropy Vulnerability
• GHSA-v42g-7q2x-cw32緊急 9.8Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
• GHSA-2x36-qhx3-7m5f緊急 9.8ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select