ZendFramework potential SQL Injection Vector When Using PDO_MySql
Published 7 Jun 2024 · Updated 7 Jun 2024
Affected packages
- Affected
- >=1.10.0 <1.10.9
- Fixed in
- 1.10.9
composer require zendframework/zendframework1:^1.10.9- Affected
- >=1.11.0 <1.11.6
- Fixed in
- 1.11.6
composer require zendframework/zendframework1:^1.11.6Details
Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:
http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on.
Is GHSA-qf36-fx9f-232x in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected zendframework/zendframework1, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.