CVE-2016-4861

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN18926672/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158Third Party Advisory, VDB Entry
https://framework.zend.com/security/advisory/ZF2016-03Exploit, Technical Description, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/06/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT/
https://security.gentoo.org/glsa/201804-10
http://jvn.jp/en/jp/JVN18926672/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158Third Party Advisory, VDB Entry
https://framework.zend.com/security/advisory/ZF2016-03Exploit, Technical Description, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/06/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT/
https://security.gentoo.org/glsa/201804-10

Timeline

Published: Feb 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-48628.8Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated user CVE-2016-48634.3The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 wit CVE-2016-48647.5H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string spec CVE-2016-48654.8Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web scrip CVE-2016-48664.8Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web scrip CVE-2016-48674.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information vi CVE-2016-48684.3Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unin CVE-2016-48696.5Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.CVE-2016-48705.4Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or CVE-2016-48716.5Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.CVE-2016-48724.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects CVE-2016-48734.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.