-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper null byte handling in PDO adapters. The security advisory explicitly mentions the fix was implemented in Zend_Db_Adapter_Pdo_Abstract by adding null byte filtering via addcslashes. The quote() method is responsible for value escaping in database adapters, and the absence of null byte escaping in this method would directly enable the injection vector. This matches the described attack pattern where unfiltered null bytes allow SQL statement termination and injection.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework1 | composer | >= 1.12.0, < 1.12.16 | 1.12.16 |
Ongoing coverage of React2Shell