{"items":[{"id":"NVI-00002820","kind":"vulnerability","title":"Zendframework1 Potential SQL injection in ORDER and GROUP functions","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6fqw-j3vm-7f66"],"plain_summary":"OSV carries this publisher advisory for zendframework/zendframework1. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.12.20 for zendframework/zendframework1. Confirm the publisher’s latest guidance.","source_ids":["sr-2813ffa9f5409fbf205b3de059b51dd7"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2813ffa9f5409fbf205b3de059b51dd7","url":"https://github.com/advisories/GHSA-6fqw-j3vm-7f66","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6fqw-j3vm-7f66","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.935Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2813ffa9f5409fbf205b3de059b51dd7"],"technology":"zendframework/zendframework1","known_exclusions":[],"conditions_summary":"The implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur.\n\nThe implementation of ORDER BY and GROUP BY in Zend_Db_Select of ZF1 is vulnerable by the following SQL injection:\n```\n$db = Zend_Db::factory(/* options here */);\n$select = new Zend_Db_Select($db);\n$select->from('p');\n$select->order(\"MD5(\\\"a(\\\");DELETE FROM p2; #)\"); // same with group()\n```\nThe above $select will render the following SQL statement:\n```\nSELECT `p`.* FROM `p` ORDER BY MD5(\"a(\");DELETE FROM p2; #) ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"p\" ORDER BY \"MD5(\"\"a(\"\");DELETE FROM p2; #)\" ASC\n```\nThis security fix can be considered an improvement of the previous ZF2016-02 and ZF2014-04 advisories.\n\nAs a final consideration, we recommend developers either never use user input for these operations, or filter user input thoroughly prior to invoking Zend_Db. You can use the Zend_Db_Select::quoteInto() method to filter the input data, as show","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 1.12.20"]}],"null_published_at":"2026-10-31T22:12:38.453Z","source_updated_at":"2024-12-04T05:45:55.735Z","source_disclosed_at":"2024-06-07T22:27:32.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:59.935Z"}],"next_cursor":null,"snapshot_revision":"42594"}