Cakephp/Database (< 4.5.12, >= 4.6.0 < 4.6.5, >= 5.0.0 < 5.1.9, >= 5.2.0 < 5.2.14, >= 5.3.0 < 5.3.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cakephp/database--4.5.12--4.6.0--4.6.5--5.0.0--5.1.9--5.2.0--5.2.14--5.3.0--5.3.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 01:10:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection Vulnerability in CakePHP FunctionsBuilderhttps://feed.craftedsignal.io/briefs/2026-09-cakephp-sql-injection/Fri, 18 Sep 2026 01:10:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cakephp-sql-injection/Multiple methods in the CakePHP FunctionsBuilder component are vulnerable to SQL injection when user-supplied input is passed to specific functional parameters.The CakePHP framework contains a critical SQL injection vulnerability (CVE-2026-79752) affecting the FunctionsBuilder component. The vulnerability exists in the cast($field, $dataType), extract($part, $expr), datePart($part, $expr), and dateAdd($expr, $value, $unit) methods. An attacker can exploit this flaw by supplying malicious user-controlled input to the $dataType, $part, or $unit parameters of these functions. If an application fails to sanitize or validate input before passing it to these parameters, an attacker can manipulate the resulting SQL query, potentially leading to unauthorized database access, data exfiltration, or modification. This issue impacts multiple versions of the cakephp/database and cakephp/cakephp packages across the 4.x and 5.x branches. Organizations using these versions are encouraged to update to the patched releases immediately.

Impact

Successful exploitation of this vulnerability allows unauthenticated or authenticated attackers to execute arbitrary SQL commands against the database used by the CakePHP application. The impact includes the potential for full database compromise, unauthorized disclosure of sensitive information, and loss of data integrity. All applications leveraging the vulnerable FunctionsBuilder methods with dynamic user input are at risk, regardless of the sector.

Recommendation

  • Upgrade the cakephp/database and cakephp/cakephp packages to the versions containing the security fix: 5.3.7, 5.2.14, 5.1.9, 4.6.5, or 4.5.12.
  • Audit existing application code to identify any instances where user-supplied data is passed directly into FunctionsBuilder methods without strict validation or allowlisting.
  • Implement a temporary workaround by ensuring that all user-supplied data passed to cast, extract, datePart, and dateAdd parameters is hardcoded or strictly filtered against a known-safe list of values before function invocation.
]]>criticaladvisorysql-injectionvulnerabilityweb-application