Zend Framework Sqlsrv Driver Multiple SQL Injection Vulnerabilities

Bugtraq ID:	70011
Class:	Input Validation Error
CVE:	CVE-2014-8089
Remote:	Yes
Local:	No
Published:	Sep 22 2014 12:00AM
Updated:	Jul 15 2015 12:04AM
Credit:	Jonas Sandström
Vulnerable:	Zend Zend Framework 1.11.6 Zend Zend Framework 1.11.4 Zend Zend Framework 1.11.3 Zend Zend Framework 1.10.9 Zend Zend Framework 1.10.4 Zend Zend Framework 1.10.3 Zend Zend Framework 1.10.2 Zend Zend Framework 1.9.8 Zend Zend Framework 1.9.7 Zend Zend Framework 1.9.6 Zend Zend Framework 1.9.5 Zend Zend Framework 1.9.4 Zend Zend Framework 1.9.3 Zend Zend Framework 1.9.2 Zend Zend Framework 1.9.1 Zend Zend Framework 1.9 Zend Zend Framework 1.8.5 Zend Zend Framework 1.8.3 Zend Zend Framework 1.8.2 Zend Zend Framework 1.8.1 Zend Zend Framework 1.8 Zend Zend Framework 1.7.9 Zend Zend Framework 1.7.8 Zend Zend Framework 1.7.7 Zend Zend Framework 1.7.6 Zend Zend Framework 1.7.5 Zend Zend Framework 1.7.4 Zend Zend Framework 1.7.3 Zend Zend Framework 1.7.2 Zend Zend Framework 1.7.1 Zend Zend Framework 1.7 Zend Zend Framework 1.7 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Zend Framework Sqlsrv Driver Multiple SQL Injection Vulnerabilities

Zend Framework is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

Zend Framework Sqlsrv Driver Multiple SQL Injection Vulnerabilities

An attacker can exploit these issues using a web browser and readily available tools.

Zend Framework Sqlsrv Driver Multiple SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Zend Framework Sqlsrv Driver Multiple SQL Injection Vulnerabilities

References:

• Zend Framework Homepage (Zend)