CVE-2014-8089: SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, wh...

Security readout for executives and security teams

This flaw can let a remote attacker manipulate database queries in some Zend Framework applications that use Microsoft SQL Server through PHP's sqlsrv extension. The business risk is unauthorized database access or changes, but only systems matching that specific framework and driver combination appear exposed in the provided sources. Likely exposure is legacy PHP applications using vulnerable Zend Framework versions with the sqlsrv PHP extension. Applications not using sqlsrv, not using Zend Framework, or already on fixed versions are not shown as affected by the provided sources. Prioritize this where legacy Zend applications connect to SQL Server through sqlsrv, especially if internet-facing or handling sensitive data. Fleet-wide urgency depends on whether that stack exists. The absence of CVSS and KEV evidence limits certainty, but SQL injection can have severe business impact. Mitigation focus: Upgrade Zend Framework to 1.12.9, 2.2.8, 2.3.3, or later as applicable.; Review the Zend security advisory for version-specific remediation guidance.; Prioritize systems using the sqlsrv PHP extension and Microsoft SQL Server..

Prepared

Jun 6, 2026, 02:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.