The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.
For instance, the following code is affected by this issue:
$db = Zend_Db::factory( /* options here */ );
$select = $db->select()
->from(array('p' => 'products'))
->order('MD5(1); drop table products');
echo $select;
This code produce the string:
SELECT "p".* FROM "products" AS "p" ORDER BY MD5(1);drop table products ASC
instead of the correct one:
SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);drop table products" ASC
The SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.
CPE | Name | Operator | Version |
---|---|---|---|
zendframework/zendframework1 | lt | 1.12.7 |