GHSA-qf36-fx9f-232x: 
PHP vulnerability analysis and mitigation

A critical SQL injection vulnerability was identified in ZendFramework (versions 1.10.0-1.10.9 and 1.11.0-1.11.6) when using PDO_MySQL with non-ASCII-compatible encodings. The vulnerability, tracked as GHSA-qf36-fx9f-232x, affects developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP, while those using ASCII-compatible encodings like UTF8 or latin1 are not affected (Zend Advisory).

The vulnerability stems from the PDO MySQL driver's inability to properly handle character set information in versions prior to PHP 5.3.6. The issue specifically affects PDO's quoting mechanisms when used with non-ASCII compatible encodings. The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity impacts on confidentiality, integrity, and availability with network-based attack vectors requiring no privileges or user interaction (GitHub Advisory).

When exploited, this vulnerability could lead to SQL injection attacks in applications using non-ASCII compatible encodings with PDO MySQL. The impact is particularly severe as it affects PDO's quoting mechanisms and emulated prepared statements, potentially allowing unauthorized access to or modification of database contents (Zend Advisory).

The vulnerability can be exploited when using non-ASCII-compatible encodings such as GBK with PDO MySQL. A proof of concept demonstrated that using PDO::quote() with specific character sequences could bypass SQL injection protections, potentially exposing all tables on the server (PHP Bug).

The vulnerability was patched in Zend Framework versions 1.10.9 and 1.11.6. The fix ensures that charset information provided to the PDO MySQL adapter is sent both as part of the DSN and in a SET NAMES query. Users are strongly recommended to upgrade to PHP 5.3.6 or later and use Zend Framework version 1.11.6 or greater, or 1.10.9 if using the 1.10 series (Zend Advisory).