Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. zendframework/zendframework1
  4. ›
  5. GHSA-qf36-fx9f-232x

GHSA-qf36-fx9f-232x: ZendFramework potential SQL Injection Vector When Using PDO_MySql

June 7, 2024

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:

http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO’s quoting mechanisms are utilized, which Zend Framework also relies on.

References

  • framework.zend.com/security/advisory/ZF2011-02
  • github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2011-02.yaml
  • github.com/advisories/GHSA-qf36-fx9f-232x
  • github.com/zendframework/zf1

Code Behaviors & Features

Detect and mitigate GHSA-qf36-fx9f-232x with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions starting from 1.10.0 before 1.10.9, all versions starting from 1.11.0 before 1.11.6

Fixed versions

  • 1.10.9
  • 1.11.6

Solution

Upgrade to versions 1.10.9, 1.11.6 or above.

Impact 9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Source file

packagist/zendframework/zendframework1/GHSA-qf36-fx9f-232x.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:25 +0000.