GHSA-2x36-qhx3-7m5f: 
PHP vulnerability analysis and mitigation

A critical SQL injection vulnerability was discovered in Zend Framework 1's implementation of the ORDER BY SQL statement in Zend_Db_Select component. The vulnerability affects versions 1.12.0 through 1.12.7 and was disclosed on June 11, 2014. This security flaw occurs when the query string containing parentheses is passed to the order() function, allowing potential SQL injection attacks (Zend Advisory).

The vulnerability stems from improper handling of parentheses in ORDER BY statements. When creating a new Zend_Db_Expr() object, the system passes the value directly without proper filtering when parentheses are present. The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical), with attack vector: Network, attack complexity: Low, privileges required: None, user interaction: None, scope: Unchanged, and high impact on confidentiality, integrity, and availability. The vulnerability is classified as CWE-89 (GitHub Advisory).

The vulnerability allows attackers to perform SQL injection attacks through the ORDER BY clause. For example, a malicious query like 'MD5(1); drop table products' would be executed as 'SELECT "p".* FROM "products" AS "p" ORDER BY MD5(1);drop table products ASC' instead of being properly quoted, potentially allowing unauthorized database operations (Zend Advisory).

The vulnerability requires no special privileges or user interaction to exploit, making it highly exploitable. An attacker can execute the exploit remotely through network access, with low attack complexity (GitHub Advisory).

The issue has been fixed in Zend Framework 1.12.7 by implementing a more granular regular expression to match only SQL functions in ORDER BY statements. The new regex '/^[\w](.))$/' replaced the previous '/(.*))/' pattern. Users should upgrade to version 1.12.7 or later to receive the security fix. It's worth noting that this vulnerability does not affect Zend Framework 2 versions as the implementation of Zend\Db\Sql\Select::order() handles parenthetical expressions differently (Zend Advisory).

The vulnerability was discovered by Cassiano Dal Pizzol, analyzed and reported by Lars Kneschke, and patched by Enrico Zimuel. The Zend Framework team acknowledged their contributions in helping protect the framework's users (Zend Advisory).