GHSA-6fqw-j3vm-7f66: 
PHP vulnerability analysis and mitigation

A critical SQL injection vulnerability was discovered in Zend Framework 1's implementation of ORDER BY and GROUP BY functions within the Zend_Db_Select component. The vulnerability, identified as GHSA-6fqw-j3vm-7f66, affects versions prior to 1.12.20 and was disclosed on September 8, 2016. The issue occurs when a combination of SQL expressions and comments are used, potentially allowing malicious SQL injection attacks (Zend Advisory).

The vulnerability exists in the Zend_Db_Select component where ORDER BY and GROUP BY functions fail to properly sanitize input when SQL expressions and comments are combined. When exploited, an attacker could inject malicious SQL statements that would be executed by the database. For example, a malicious input like 'MD5("a(");DELETE FROM p2; #)' would be processed incorrectly, resulting in the execution of unauthorized SQL commands. The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8, indicating high impact potential across confidentiality, integrity, and availability vectors (GitHub Advisory).

The vulnerability allows attackers to execute arbitrary SQL commands through the ORDER BY and GROUP BY functions, potentially leading to unauthorized data access, modification, or deletion of database contents. The high CVSS score of 9.8 indicates critical severity with potential for significant impact on system confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability can be exploited remotely without requiring any special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward for attackers to exploit. The vulnerability specifically affects the ORDER BY and GROUP BY functions when processing user input containing SQL expressions and comments (GitHub Advisory).

The vulnerability has been patched in Zend Framework 1.12.20. The fix implements a comprehensive solution that identifies and removes comments prior to checking statement validity. For users unable to upgrade immediately, it is recommended to either avoid using user input for ORDER and GROUP operations or thoroughly filter input using the Zend_Db_Select::quoteInto() method. The patch includes a regex-based solution to remove SQL comments before processing the statements (Zend Advisory).