Fluid Attacks Database

Description

Zend Framework SQL injection vulnerability SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	zendframework/zend-db	>=2.0.0 <2.0.99 \|\| >=2.1.0 <2.1.99 \|\| >=2.2.0 <2.2.8 \|\| >=2.3.0 <2.3.3	2.0.99, 2.1.99, 2.2.8, 2.3.3
packagist	zendframework/zendframework	>=2.0.0 <2.0.99 \|\| >=2.1.0 <2.1.99 \|\| >=2.2.0 <2.2.8 \|\| >=2.3.0 <2.3.3	2.0.99, 2.1.99, 2.2.8, 2.3.3
packagist	zendframework/zendframework1	>=1.12.0 <1.12.9	1.12.9

Aliases

1. CVE-2014-80892. NVD-2014-80893. OSV-2014-80894. GCVE-2014-8089

References

1. https://bugzilla.redhat.com/show_bug.cgi?id=11512772. https://framework.zend.com/security/advisory/ZF2014-063. https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml4. https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml5. https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml6. http://framework.zend.com/security/advisory/ZF2014-067. http://seclists.org/oss-sec/2014/q4/2768. http://www.securityfocus.com/bid/70011