CakePHP SQL Injection Vulnerability: Assess Your Exposure Now
- Severity
- HIGH
- Affected component
- cakephp (packagist)
- Affected versions
- < 4.5.12 or >= 4.6.0, < 4.6.5 or >= 5.0.0, < 5.1.9 or >= 5.2.0, < 5.2.14 or >= 5.3.0, < 5.3.7
- Patched version
- 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12
An early warning has been issued regarding a SQL injection vulnerability in CakePHP's FunctionsBuilder methods. Users of affected versions should assess their exposure and apply necessary upgrades.
What happened
An early warning has been issued for a SQL injection vulnerability in CakePHP. The FunctionsBuilder::cast, extract, datePart, and dateAdd methods are reportedly vulnerable if user-controlled data is supplied to the parameters. This vulnerability affects versions less than 4.5.12, versions between 4.6.0 and 4.6.5, versions between 5.0.0 and 5.1.9, versions between 5.2.0 and 5.2.14, and versions between 5.3.0 and 5.3.7.
The vulnerability is under investigation and has not yet been exploited in the wild. However, it is recommended that users of affected versions upgrade to one of the fixed versions to mitigate potential risks.
What to do about it
- Upgrade to one of the fixed versions: 5.3.7, 5.2.14, 5.1.9, 4.6.5, or 4.5.12.
- Review your application's use of the FunctionsBuilder::cast, extract, datePart, and dateAdd methods to ensure they are not vulnerable to SQL injection.
- Monitor the primary sources for updates on the vulnerability and any additional fixes that may be released.
How 0Day would have caught this
cakephp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using CakePHP versions less than 4.5.12, versions between 4.6.0 and 4.6.5, versions between 5.0.0 and 5.1.9, versions between 5.2.0 and 5.2.14, or versions between 5.3.0 and 5.3.7.
What should I do right now?
Upgrade to one of the fixed versions: 5.3.7, 5.2.14, 5.1.9, 4.6.5, or 4.5.12. Review your application's use of the vulnerable methods and monitor the primary sources for updates.
Has this vulnerability been exploited in the wild?
No, the vulnerability has not yet been exploited in the wild according to the current information.