NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
CRITICAL severity

ZendFramework potential SQL Injection Vector When Using PDO_MySqlGHSA-qf36-fx9f-232x

CRITICAL

GHSA-qf36-fx9f-232x is a critical-severity (CVSS 9.8) vulnerability in zendframework/zendframework1. A fix is available for zendframework/zendframework1 — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Jun 7, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐘zendframework/zendframework1🐘zendframework/zendframework1

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:

http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistzendframework/zendframework1≥ 1.10.0&&< 1.10.91.10.9composer require zendframework/zendframework1:^1.10.9
🐘Packagistzendframework/zendframework1≥ 1.11.0&&< 1.11.61.11.6composer require zendframework/zendframework1:^1.11.6

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zendframework/zendframework1, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update zendframework/zendframework1 to 1.10.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qf36-fx9f-232x is resolved across your whole dependency graph.

  3. Workarounds

    Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Frequently Asked Questions

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here: http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanis
O3 Security · Impact-Aware SCA

Is GHSA-qf36-fx9f-232x in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
ZendFramework potential SQL Injection Vector When…