Zend Framework up to 1.12.6 SQL Statement Zend_Db_Select::order ORDER BY Statement sql injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in Zend Framework up to 1.12.6. This affects the function Zend_Db_Select::order of the component SQL Statement Handler. This manipulation as part of ORDER BY Statement causes sql injection. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Zend Framework up to 1.12.6 (Programming Tool Software). Affected by this vulnerability is the function Zend_Db_Select::order of the component SQL Statement Handler. The manipulation as part of a ORDER BY Statement leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was shared 06/12/2014 by Cassiano Dal Pizzol as ZF2014-04 as confirmed advisory (Website). The advisory is shared at framework.zend.com. The vendor cooperated in the coordination of the public release. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. MITRE ATT&CK project uses the attack technique T1505 for this issue.

A public exploit has been developed in PHP/SQL and been published immediately after the advisory. It is possible to download the exploit at framework.zend.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k.

Upgrading to version 1.12.7 or 2.0 eliminates this vulnerability. The advisory contains the following remark:

We fixed the issue in the Zend_Db_Select::order() function using a more granular regular expression to match only SQL functions in an ORDER BY statement, such as ORDER BY ABS("zfproducts"."product_id"). The new regular expression is '/^[\w]*\(.*\)$/' instead of the previous '/\(.*\)/'. (…) This SQL injection attack does not affect Zend Framework 2 versions because the implementation of Zend\Db\Sql\Select::order() does not manage parenthetical expressions.

The vulnerability is also documented in the vulnerability database at Secunia (SA58847†). The entry VDB-111160 is related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Not Affected

• Zend Framework 2.x

Productinfo

Type

• Programming Tool Software

Vendor

• Zend

Name

• Framework

Version

• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion