Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Zend Framework 1.12.18 and earlier may allow SQL injection via crafted input

CVE-2016-6233 · published 9 years ago
Summary

If you use Zend Framework 1.12.18 or earlier, attackers could potentially inject malicious SQL code into your database, leading to unauthorized data access or modification. This is a significant security risk. To protect your system, update to Zend Framework 1.12.19 or later.

What to do
  • Update zendframework zendframework to version 1.12.19.
  • Update zendframework zendframework1 to version 1.12.19.
Affected software
Ecosystem VendorProductAffected versions
composer zendframework zendframework < 1.12.19
Fix: upgrade to 1.12.19
composer zendframework zendframework1 < 1.12.19
Fix: upgrade to 1.12.19
– fedoraproject fedora 23
24
25
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
– zend zend_framework <= 1.12.19
cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*
Original advisory text
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character ...
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published17 Feb 2017
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-p9hp-3gpv-52w3 · GHSA
CVE-2016-6233 · NVD
Track software like this
Free during beta