Database (5.1.x, 5.2.x, 5.3.x) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/database-5.1.x-5.2.x-5.3.x/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 21:49:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in CakePHP FunctionsBuilderhttps://feed.craftedsignal.io/briefs/2026-09-cakephp-sql-injection/Tue, 08 Sep 2026 21:49:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cakephp-sql-injection/The CakePHP framework contains an SQL injection vulnerability in the FunctionsBuilder::jsonValue() method when using the Postgres driver, allowing unauthorized database command execution via user-controlled jsonPath input.The CakePHP framework contains a critical SQL injection vulnerability identified as CVE-2026-77635. The flaw exists within the FunctionsBuilder::jsonValue($field, $jsonPath) method specifically when utilizing the Postgres driver. Attackers can exploit this vulnerability by supplying malicious, user-controlled input to the $jsonPath parameter. Because the framework does not adequately sanitize this parameter before incorporating it into SQL queries sent to the PostgreSQL backend, an attacker can append arbitrary SQL commands, potentially leading to unauthorized data extraction, modification, or deletion within the database. The vulnerability affects versions 5.1.x, 5.2.x, and 5.3.x of the cakephp/cakephp and cakephp/database packages.

Impact

Successful exploitation of this vulnerability allows unauthenticated or authenticated attackers to perform unauthorized database operations, which may lead to full database compromise, exfiltration of sensitive application data, or remote code execution depending on the database configuration and permissions. All applications using the affected CakePHP versions with a PostgreSQL backend are at risk.

Recommendation

Prioritized remediation steps include:

  • Upgrade the cakephp/cakephp and cakephp/database packages to versions 5.1.10, 5.2.15, or 5.3.7 or later to address CVE-2026-77635.
  • Audit application codebases for instances where user-supplied input is directly passed to the $jsonPath parameter of FunctionsBuilder::jsonValue().
  • Implement strict input validation and allowlisting for any data intended for database query parameters until patching can be completed.
  • Review database query logs for unusual syntax, such as SQL comments, union operators, or concatenation patterns originating from web application controllers that interface with the affected methods.
]]>highadvisorysql-injectionvulnerabilityweb-application