{"items":[{"id":"NVI-00007960","kind":"vulnerability","title":"ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-x2f4-8wxf-w3vf"],"plain_summary":"OSV carries this publisher advisory for zendframework/zendframework, zendframework/zendframework. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.0.8 for zendframework/zendframework. Confirm the publisher’s latest guidance.","source_ids":["sr-eff17da725ba62b53f5eaf87c80de199"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.1.4 for zendframework/zendframework. Confirm the publisher’s latest guidance.","source_ids":["sr-eff17da725ba62b53f5eaf87c80de199"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-eff17da725ba62b53f5eaf87c80de199","url":"https://github.com/advisories/GHSA-x2f4-8wxf-w3vf","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-x2f4-8wxf-w3vf","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:51.437Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-eff17da725ba62b53f5eaf87c80de199"],"technology":"zendframework/zendframework","known_exclusions":[],"conditions_summary":"The `Zend\\Db` component in Zend Framework 2 provides platform abstraction, which is used in particular for SQL abstraction. Two methods defined in the platform interface, `quoteValue()` and `quoteValueList()`, allow users to manually quote values for creating SQL statements; these are in turn consumed by aspects of the SQL abstraction platform, including `Zend\\Db\\Sql\\Sql::getSqlStringForSqlObject()`, and the `getSqlString()` method provided in a number of classes in the Zend\\Db\\Sql namespace.\n\nWhile these methods are primarily intended for debugging and logging purposes, developers can use them to produce SQL that is then passed to the driver to execute. Due to a flaw in how the `quoteValue()` and `quoteValueList()` methods were written, this can lead to potential SQL injection.\n\nThe offending code is located in any of the `Zend\\Db\\Adapter\\Platform*` objects, particularly the quoteValue() and `quoteValueList()` methods. These methods did not take into account most of the possible escapable characters that would need to be escaped when attempting to create a quoted value for interpolation into a SQL string. Moreover, these methods did value quoting without extension level coordinati","public_affected_ranges":["ECOSYSTEM: introduced 2.0.0; fixed 2.0.8"]},{"certainty":"source_listed","source_ids":["sr-eff17da725ba62b53f5eaf87c80de199"],"technology":"zendframework/zendframework","known_exclusions":[],"conditions_summary":"The `Zend\\Db` component in Zend Framework 2 provides platform abstraction, which is used in particular for SQL abstraction. Two methods defined in the platform interface, `quoteValue()` and `quoteValueList()`, allow users to manually quote values for creating SQL statements; these are in turn consumed by aspects of the SQL abstraction platform, including `Zend\\Db\\Sql\\Sql::getSqlStringForSqlObject()`, and the `getSqlString()` method provided in a number of classes in the Zend\\Db\\Sql namespace.\n\nWhile these methods are primarily intended for debugging and logging purposes, developers can use them to produce SQL that is then passed to the driver to execute. Due to a flaw in how the `quoteValue()` and `quoteValueList()` methods were written, this can lead to potential SQL injection.\n\nThe offending code is located in any of the `Zend\\Db\\Adapter\\Platform*` objects, particularly the quoteValue() and `quoteValueList()` methods. These methods did not take into account most of the possible escapable characters that would need to be escaped when attempting to create a quoted value for interpolation into a SQL string. Moreover, these methods did value quoting without extension level coordinati","public_affected_ranges":["ECOSYSTEM: introduced 2.1.0; fixed 2.1.4"]}],"null_published_at":"2026-10-31T22:13:18.642Z","source_updated_at":"2024-12-04T05:35:16.874Z","source_disclosed_at":"2024-06-07T20:35:15.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:51.437Z"}],"next_cursor":null,"snapshot_revision":"42594"}