Name of the Vulnerable Software and Affected Versions: Zend Db Select (affected versions not specified)

Description: The implementation of ORDER BY and GROUP BY in Zend Db Select is prone to SQL injection when a combination of SQL expressions and comments are used. This issue can be exploited by injecting malicious SQL code, such as MD5("a(");DELETE FROM p2; #), which can lead to unauthorized data modification or deletion. The vulnerability can be mitigated by properly filtering user input prior to invoking Zend Db.

Recommendations: To resolve the issue, developers should either never use user input for ORDER BY and GROUP BY operations or filter user input thoroughly prior to invoking Zend Db. Use the quoteInto() method to filter the input data, as shown in the example:

$db  = Zend Db::factory(...);
$input = "MD5("a(");DELETE FROM p2; #)"; 
$order = $db->quoteInto("SQL statement for ORDER", $input);