CVE-2016-6233: SQL Injection

February 17, 2017 (updated October 21, 2018)

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.

References

www.securityfocus.com/bid/91802
framework.zend.com/security/advisory/ZF2016-02
nvd.nist.gov/vuln/detail/CVE-2016-6233

Code Behaviors & Features

Detect and mitigate CVE-2016-6233 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →