CVE-2014-8089

Description

SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

Weakness classification

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references

• cve@mitre.org — Exploit, Vendor Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory