Zend Framework 'PDO_MySql' Security Bypass Vulnerability

Bugtraq ID:	47919
Class:	Design Error
CVE:	CVE-2011-1939
Remote:	Yes
Local:	No
Published:	May 19 2011 12:00AM
Updated:	Apr 16 2015 05:43PM
Credit:	Anthony Ferrara
Vulnerable:	Zend Zend Framework 1.11.4 Zend Zend Framework 1.11.3 Zend Zend Framework 1.10.4 Zend Zend Framework 1.10.3 Zend Zend Framework 1.10.2 Gentoo Linux
Not Vulnerable:	Zend Zend Framework 1.11.6 Zend Zend Framework 1.10.9 PHP PHP 5.3.6

Zend Framework 'PDO_MySql' Security Bypass Vulnerability

Zend Framework is prone to a security-bypass vulnerability.

An attacker can leverage this vulnerability to bypass certain security restrictions. Successful exploits may allow attackers to exploit SQL-injection vulnerabilities.

Zend Framework versions prior to 1.10.9 and 1.11.6 are vulnerable.

Zend Framework 'PDO_MySql' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Zend Framework 'PDO_MySql' Security Bypass Vulnerability

References:

• Zend Framework Homepage (Zend)
  
• Security AdvisoryZF2011-02: Potential SQL Injection Vector When Using PDO_MySql (Zend)