{"id":"CVE-2012-5657","aliases":["CLSA-2026-1787038633","CLSA-2026-1787157563","DEBIAN-CVE-2012-5657","DSA-2602-1","EUVD-2022-3410","GHSA-229x-22xc-2f2w","GHSA-2x36-qhx3-7m5f","GHSA-6fqw-j3vm-7f66","GHSA-848f-mph5-9pm9","GHSA-8xhv-gqm4-3w99","GHSA-9m5v-vq4f-mrvf","GHSA-9v78-h226-2rmq","GHSA-mhpx-3rv8-wrjm","GHSA-v42g-7q2x-cw32","UBUNTU-CVE-2012-5657"],"status":"published","title":"Zendframework Local file disclosure via XXE injection in Zend_XmlRpc","description":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01705,"percentile":0.77436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-287","CWE-331","CWE-611","CWE-776","CWE-89"],"published":"2013-01-08T00:00:00Z","modified":"2026-10-15T09:48:00Z","fixes":[{"ecosystem":"Packagist","package":"zendframework/zendframework1","fixed_in":["1.11.13","1.12.7","1.12.20","1.12.17","1.12.18","1.11.15","1.12.1","1.12.4","1.12.16"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:6.0","package":"zendframework","fixed_in":["1.10.6-1squeeze2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.11.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.20"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.17"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.18"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.15"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0-rc1"},{"fixed":"1.12.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.16"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.0-p2+tuxcare"}]}],"versions":["1.11.0","1.11.0-p1+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.6"},{"fixed":"1.10.6-p1+tuxcare"}]}],"versions":["1.10.6"],"bundled":15},{"source":"osv","ecosystem":"Debian:6.0","package":"zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1squeeze2"}]}],"versions":["1.10.6-1","1.10.6-1squeeze1"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.11.13"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.20"}]}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.16","1.12.17","1.12.18","1.12.19","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.17"}]}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.16","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.18"}]}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.16","1.12.17","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.15"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0-rc1"},{"fixed":"1.12.1"}]}],"versions":["1.12.0"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.16"}]}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zend-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.11-0ubuntu2","1.11.11-0ubuntu3","1.11.11-0ubuntu3.16.04.1"]}],"products":[{"vendor":"zend","product":"zend_framework"}],"references":[{"url":"http://openwall.com/lists/oss-security/2012/12/20/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2602","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:115","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://framework.zend.com/security/advisory/ZF2012-05","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"http://secunia.com/advisories/51583","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","report"]},{"url":"http://openwall.com/lists/oss-security/2012/12/20/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-01.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20210620092354/https://framework.zend.com/security/advisory/ZF2012-01","tags":["web"]},{"url":"https://github.com/advisories/GHSA-229x-22xc-2f2w"},{"url":"https://framework.zend.com/security/advisory/ZF2014-04","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-04.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2x36-qhx3-7m5f"},{"url":"https://framework.zend.com/security/advisory/ZF2016-03","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-03.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6fqw-j3vm-7f66"},{"url":"https://framework.zend.com/security/advisory/ZF2015-09","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-09.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-848f-mph5-9pm9"},{"url":"https://framework.zend.com/security/advisory/ZF2016-01","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-01.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8xhv-gqm4-3w99"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5657","tags":["advisory"]},{"url":"https://github.com/zendframework/zf1/commit/15c84914f063efea49ea1c4425459a792cc185ea","tags":["web"]},{"url":"https://web.archive.org/web/20131101014013/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9m5v-vq4f-mrvf"},{"url":"https://framework.zend.com/security/advisory/ZF2014-02","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-02.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9v78-h226-2rmq"},{"url":"https://framework.zend.com/security/advisory/ZF2014-01","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-01.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mhpx-3rv8-wrjm"},{"url":"https://framework.zend.com/security/advisory/ZF2015-08","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-08.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v42g-7q2x-cw32"},{"url":"https://github.com/zendframework/zf1","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2012-5657","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2012/12/20/2","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5657","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2012-5657","description":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","status":"published","published":"2013-05-02T14:00:00Z","modified":"2024-08-06T21:14:16.432Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2022-3410","description":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","status":"published","published":"2013-05-02T14:00:00Z","modified":"2024-08-06T21:14:16Z","updated_at":"2026-11-03T01:56:04.024018Z"}],"ghsa":[{"id":"GHSA-229x-22xc-2f2w","title":"Zendframework Local file disclosure via XXE injection in Zend_XmlRpc","description":"Zend_XmlRpc is vulnerable to XML eXternal Entity (XXE) Injection attacks. The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n\n","status":"published","published":"2024-06-07T21:39:43Z","modified":"2024-06-07T21:39:44Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:53.703286Z"},{"id":"GHSA-2x36-qhx3-7m5f","title":"ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select","description":"The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.\n\nFor instance, the following code is affected by this issue:\n```\n$db     = Zend_Db::factory( /* options here */ );\n$select = $db-\u003eselect()\n    -\u003efrom(array('p' =\u003e 'products'))\n    -\u003eorder('MD5(1); drop table products');\necho $select;\n```\nThis code produce the string:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY MD5(1);drop table products ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY \"MD5(1);drop table products\" ASC\n```\nThe SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.","status":"published","published":"2024-06-07T22:24:52Z","modified":"2024-06-07T22:24:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-6fqw-j3vm-7f66","title":"Zendframework1 Potential SQL injection in ORDER and GROUP functions","description":"The implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur.\n\nThe implementation of ORDER BY and GROUP BY in Zend_Db_Select of ZF1 is vulnerable by the following SQL injection:\n```\n$db = Zend_Db::factory(/* options here */);\n$select = new Zend_Db_Select($db);\n$select-\u003efrom('p');\n$select-\u003eorder(\"MD5(\\\"a(\\\");DELETE FROM p2; #)\"); // same with group()\n```\nThe above $select will render the following SQL statement:\n```\nSELECT `p`.* FROM `p` ORDER BY MD5(\"a(\");DELETE FROM p2; #) ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"p\" ORDER BY \"MD5(\"\"a(\"\");DELETE FROM p2; #)\" ASC\n```\nThis security fix can be considered an improvement of the previous ZF2016-02 and ZF2014-04 advisories.\n\nAs a final consideration, we recommend developers either never use user input for these operations, or filter user input thoroughly prior to invoking Zend_Db. You can use the Zend_Db_Select::quoteInto() method to filter the input data, as shown in this example:\n```\n$db    = Zend_Db::factory(...);\n$input = \"MD5(\\\"a(\\\");DELETE FROM p2; #)\"; // user input can be an attack\n$order = $db-\u003equoteInto(\"SQL statement for ORDER\", $input);\n\n$select = new Zend_Db_Select($db);\n$select-\u003efrom('p');\n$select-\u003eorder($order); // same with group()\n```","status":"published","published":"2024-06-07T22:27:32Z","modified":"2024-06-07T22:27:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-848f-mph5-9pm9","title":"Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability","description":"In Zend Framework, Zend_Captcha_Word (v1) and Zend\\Captcha\\Word (v2) generate a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.","status":"published","published":"2024-06-07T22:27:02Z","modified":"2024-06-07T22:27:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-8xhv-gqm4-3w99","title":"ZendFramework1 Potential Insufficient Entropy Vulnerability","description":"We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:\n```\nZend_Ldap_Attribute::createPassword\nZend_Form_Element_Hash::_generateHash\nZend_Gdata_HttpClient::filterHttpRequest\nZend_Filter_Encrypt_Mcrypt::_srand\nZend_OpenId::randomBytes\n```\nIn each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.\n\nMoreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)","status":"published","published":"2024-06-07T22:26:25Z","modified":"2024-06-07T22:26:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-9v78-h226-2rmq","title":"Zendframework potential security issue in login mechanism","description":"Using the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.\n\nMoreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.","status":"published","published":"2024-06-07T22:24:08Z","modified":"2024-06-07T22:24:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-mhpx-3rv8-wrjm","title":"ZendFramework potential XML eXternal Entity injection vectors","description":"Numerous components utilizing PHP's `DOMDocument`, `SimpleXML`, and `xml_parse` functionality are vulnerable to two types of attacks:\n\n- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.\n","status":"published","published":"2024-06-07T21:16:36Z","modified":"2024-06-07T21:16:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611","CWE-776"],"updated_at":"2026-11-02T14:37:53.703286Z"},{"id":"GHSA-v42g-7q2x-cw32","title":"Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)","description":"The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.\n\nWe tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.","status":"published","published":"2024-06-07T22:25:43Z","modified":"2024-06-07T22:25:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-9m5v-vq4f-mrvf","title":"Zend Framework XXE Vulnerability","description":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","status":"published","published":"2022-05-17T05:10:46Z","modified":"2024-01-12T19:41:53Z","cwes":["CWE-200","CWE-611"],"updated_at":"2026-11-02T14:37:30.812736Z"}],"nvd":[{"id":"CVE-2012-5657","description":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","status":"published","published":"2013-05-02T14:55:05.217Z","modified":"2026-06-16T23:47:12.09Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"GHSA-229x-22xc-2f2w","title":"Zendframework Local file disclosure via XXE injection in Zend_XmlRpc","description":"Zend_XmlRpc is vulnerable to XML eXternal Entity (XXE) Injection attacks. The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n\n","status":"published","published":"2024-06-07T21:39:43Z","modified":"2024-06-07T21:39:43Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"GHSA-2x36-qhx3-7m5f","title":"ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select","description":"The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.\n\nFor instance, the following code is affected by this issue:\n```\n$db     = Zend_Db::factory( /* options here */ );\n$select = $db-\u003eselect()\n    -\u003efrom(array('p' =\u003e 'products'))\n    -\u003eorder('MD5(1); drop table products');\necho $select;\n```\nThis code produce the string:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY MD5(1);drop table products ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY \"MD5(1);drop table products\" ASC\n```\nThe SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.","status":"published","published":"2024-06-07T22:24:52Z","modified":"2024-12-04T05:39:35.461646Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"GHSA-6fqw-j3vm-7f66","title":"Zendframework1 Potential SQL injection in ORDER and GROUP functions","description":"The implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur.\n\nThe implementation of ORDER BY and GROUP BY in Zend_Db_Select of ZF1 is vulnerable by the following SQL injection:\n```\n$db = Zend_Db::factory(/* options here */);\n$select = new Zend_Db_Select($db);\n$select-\u003efrom('p');\n$select-\u003eorder(\"MD5(\\\"a(\\\");DELETE FROM p2; #)\"); // same with group()\n```\nThe above $select will render the following SQL statement:\n```\nSELECT `p`.* FROM `p` ORDER BY MD5(\"a(\");DELETE FROM p2; #) ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"p\" ORDER BY \"MD5(\"\"a(\"\");DELETE FROM p2; #)\" ASC\n```\nThis security fix can be considered an improvement of the previous ZF2016-02 and ZF2014-04 advisories.\n\nAs a final consideration, we recommend developers either never use user input for these operations, or filter user input thoroughly prior to invoking Zend_Db. You can use the Zend_Db_Select::quoteInto() method to filter the input data, as shown in this example:\n```\n$db    = Zend_Db::factory(...);\n$input = \"MD5(\\\"a(\\\");DELETE FROM p2; #)\"; // user input can be an attack\n$order = $db-\u003equoteInto(\"SQL statement for ORDER\", $input);\n\n$select = new Zend_Db_Select($db);\n$select-\u003efrom('p');\n$select-\u003eorder($order); // same with group()\n```","status":"published","published":"2024-06-07T22:27:32Z","modified":"2024-12-04T05:45:55.735836Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"GHSA-848f-mph5-9pm9","title":"Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability","description":"In Zend Framework, Zend_Captcha_Word (v1) and Zend\\Captcha\\Word (v2) generate a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.","status":"published","published":"2024-06-07T22:27:02Z","modified":"2024-12-04T05:39:36.296019Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"GHSA-8xhv-gqm4-3w99","title":"ZendFramework1 Potential Insufficient Entropy Vulnerability","description":"We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:\n```\nZend_Ldap_Attribute::createPassword\nZend_Form_Element_Hash::_generateHash\nZend_Gdata_HttpClient::filterHttpRequest\nZend_Filter_Encrypt_Mcrypt::_srand\nZend_OpenId::randomBytes\n```\nIn each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.\n\nMoreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)","status":"published","published":"2024-06-07T22:26:25Z","modified":"2024-12-04T05:41:20.457754Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"GHSA-9v78-h226-2rmq","title":"Zendframework potential security issue in login mechanism","description":"Using the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.\n\nMoreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.","status":"published","published":"2024-06-07T22:24:08Z","modified":"2024-12-04T05:30:41.11192Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"GHSA-mhpx-3rv8-wrjm","title":"ZendFramework potential XML eXternal Entity injection vectors","description":"Numerous components utilizing PHP's `DOMDocument`, `SimpleXML`, and `xml_parse` functionality are vulnerable to two types of attacks:\n\n- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.\n","status":"published","published":"2024-06-07T21:16:36Z","modified":"2024-12-04T05:32:07.571126Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611","CWE-776"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"GHSA-v42g-7q2x-cw32","title":"Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)","description":"The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.\n\nWe tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.","status":"published","published":"2024-06-07T22:25:43Z","modified":"2024-12-04T05:41:15.523998Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"CLSA-2026-1787038633","title":"TuxCare security update for zendframework/zendframework1 (10 CVEs)","description":"TuxCare rebuilt zendframework/zendframework1 to address 10 CVEs. Fixed in 1.11.0-p2+tuxcare.","status":"published","published":"2026-08-18T07:37:13Z","modified":"2026-10-15T09:48:00.241242105Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787157563","title":"TuxCare security update for zendframework/zendframework1 (23 CVEs)","description":"TuxCare rebuilt zendframework/zendframework1 to address 23 CVEs. Fixed in 1.10.6-p1+tuxcare.","status":"published","published":"2026-08-19T16:39:23Z","modified":"2026-10-15T09:47:59.795822218Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"DSA-2602-1","title":"zendframework - XML external entity inclusion","status":"published","published":"2013-01-08T00:00:00Z","modified":"2026-03-09T01:18:43.595627Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-9m5v-vq4f-mrvf","title":"Zend Framework XXE Vulnerability","description":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","status":"published","published":"2022-05-17T05:10:46Z","modified":"2024-12-04T05:37:56.368926Z","cwes":["CWE-200","CWE-611"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"UBUNTU-CVE-2012-5657","description":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","status":"published","published":"2013-05-02T14:55:00Z","modified":"2025-10-24T04:44:58Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}