Zend Framework SQL injection vector using null byte for PDO

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-7695 · ADVISORY
• zendframework/zf1 · PACKAGE
• framework.zend.com/security/advisory/ZF2015-08 · WEB
• debian.org/security/2015/dsa-3369 · WEB
• openwall.com/lists/oss-security/2015/09/30/6 · WEB
• openwall.com/lists/oss-security/2015/09/30/8 · WEB
• openwall.com/lists/oss-security/2015/10/11/3 · WEB
• securityfocus.com/bid/76784 · WEB

Mais vulnerabilidades de zendframework/zendframework1

• GHSA-6fqw-j3vm-7f66CRÍTICO 9.8Zendframework1 Potential SQL injection in ORDER and GROUP functions
• GHSA-848f-mph5-9pm9ALTO 7.5Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
• GHSA-8xhv-gqm4-3w99ALTO 7.5ZendFramework1 Potential Insufficient Entropy Vulnerability
• GHSA-v42g-7q2x-cw32CRÍTICO 9.8Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
• GHSA-2x36-qhx3-7m5fCRÍTICO 9.8ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select