-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework | composer | < 1.12.19 | 1.12.19 |
| zendframework/zendframework1 | composer | < 1.12.19 | 1.12.19 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Zend_Db_Select's order() and group() methods using an insecure regular expression ([\w]) to validate SQL column expressions. This pattern failed to properly sanitize input containing special characters or nested functions, allowing attackers to inject arbitrary SQL. The Zend Security Advisory ZF2016-02 explicitly identifies these methods and describes the regex hardening from [\w] to [\w]+ in the patch. Both methods reside in Zend/Db/Select.php, which aligns with Zend Framework 1's structure.
A Semantic Attack on Google Gemini - Read the Latest Research