Résumé
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
Détails de l’avis
Impact
The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds
Don't provide user controlled data to these functions/parameters.
Références
- https://github.com/advisories/GHSA-vjqc-q4mp-2rvf
- https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
- https://nvd.nist.gov/vuln/detail/CVE-2026-79752
- https://github.com/cakephp/cakephp/pull/19520
- https://github.com/cakephp/cakephp/pull/19528
- https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
- https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
- https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
- HIGHCVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
- HIGHCVE-2026-107375
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
- MEDIUMCVE-2026-60090
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
- HIGHCVE-2026-105856
Payload: SQL injection in SQLite/Postgres
- HIGHCVE-2026-62251
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query