CVE-2016-6233: SQL Injection

February 16, 2017 (updated October 21, 2018)

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.

References

framework.zend.com/security/advisory/ZF2016-02

Code Behaviors & Features

Detect and mitigate CVE-2016-6233 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →