{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cakephp--5.4.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-119419"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CakePHP (\u003c= 5.4.3)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","sqli","cakephp"],"_cs_type":"advisory","_cs_vendors":["Cake Software Foundation"],"content_html":"\u003cp\u003eCakePHP versions 5.4.3 and earlier are susceptible to an SQL injection vulnerability. The flaw exists within the \u003ccode\u003eStringExpression\u003c/code\u003e and \u003ccode\u003eIdentifierExpression\u003c/code\u003e classes. Attackers who can control the collation parameter passed to the constructor or the \u003ccode\u003esetCollation()\u003c/code\u003e method can inject arbitrary SQL commands. The injected payload is appended after the unquoted \u003ccode\u003eCOLLATE\u003c/code\u003e clause and executes with the privileges of the active database connection.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to execute arbitrary SQL commands against the backend database, potentially resulting in unauthorized data access, modification, or destruction, depending on the privileges of the database user configured in the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit custom application code using CakePHP to identify instances where user-supplied input is passed to \u003ccode\u003eStringExpression\u003c/code\u003e, \u003ccode\u003eIdentifierExpression\u003c/code\u003e, or the \u003ccode\u003esetCollation()\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or allow-listing for any collation parameters processed by these methods.\u003c/li\u003e\n\u003cli\u003eUpgrade to the latest version of CakePHP that includes the security patch for CVE-2026-119419 once available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T13:29:22Z","date_published":"2026-10-30T13:29:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cakephp-sql-injection-a878a2a5/","summary":"CakePHP through version 5.4.3 contains an SQL injection vulnerability in its query building components that allows unvalidated collation values to trigger arbitrary SQL execution.","title":"CakePHP: SQL injection in StringExpression and IdentifierExpression (CVE-2026-119419)","url":"https://feed.craftedsignal.io/briefs/2026-10-cakephp-sql-injection-a878a2a5/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-119418"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CakePHP (\u003c= 5.4.3)"],"_cs_severities":["high"],"_cs_tags":["sql-injection","vulnerability","web-framework"],"_cs_type":"advisory","_cs_vendors":["CakePHP"],"content_html":"\u003cp\u003eCakePHP versions through 5.4.3 contain an SQL injection vulnerability arising from the improper validation of frame offsets and directions within the \u003ccode\u003eWindowExpression::range()\u003c/code\u003e and \u003ccode\u003eframe()\u003c/code\u003e methods. Applications that pass user-supplied input into these methods, which are subsequently rendered in the \u003ccode\u003eOVER\u003c/code\u003e clause of a SQL query, are susceptible to exploitation. An attacker can leverage this flaw to execute unauthorized SQL statements using the privileges of the database connection.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized SQL execution, which can lead to data exfiltration, database modification, or denial of service depending on the application database configuration and privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all applications utilizing CakePHP versions 5.4.3 or older.\u003c/li\u003e\n\u003cli\u003eReview custom code for any usage of \u003ccode\u003eWindowExpression::range()\u003c/code\u003e or \u003ccode\u003eframe()\u003c/code\u003e that incorporates untrusted user input.\u003c/li\u003e\n\u003cli\u003eApply patches or upgrade to a version of CakePHP that addresses this vulnerability once available.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all parameters passed to framework query building methods.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T13:29:14Z","date_published":"2026-10-30T13:29:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cakephp-sql-injection/","summary":"CakePHP versions through 5.4.3 contain an SQL injection vulnerability in the WindowExpression::range() and frame() methods that allows attackers to execute arbitrary SQL via crafted input passed to the OVER clause.","title":"CakePHP: SQL injection in WindowExpression (CVE-2026-119418)","url":"https://feed.craftedsignal.io/briefs/2026-10-cakephp-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - CakePHP (\u003c= 5.4.3)","version":"https://jsonfeed.org/version/1.1"}