EUVD-2026-81673
GHSA-vjqc-q4mp-2rvf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint feeding user input to FunctionsBuilder
-
DeliverySubmit malicious dataType/part/unit value
-
ExploitValue spliced unescaped into SQL
-
ExecutionInjected structural fragment executes on DB
-
ImpactExfiltrate or alter data per DB privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the CakePHP application itself to pass attacker-controllable input into the $dataType (cast), $part (extract/datePart), or $unit (dateAdd) arguments of src/Database/FunctionsBuilder.php - these are structural SQL fragments that the framework incorporated without escaping or binding prior to the fix. This is the AT:P condition in the vendor vector: the flaw does not exist in a default application that only uses these methods with hard-coded literals. Limiting factors: the vulnerable coding pattern is not idiomatic (these parameters are typed/documented as trusted structural strings, so many applications never expose them to user input); actual impact is bounded by the database connection's granted privileges; and applications on 4.5.12/4.6.5/5.1.9/5.2.14/5.3.7 or later are protected by the alphanumeric-only ensureSimpleString() guard regardless of how they call these methods. |
| Impact | The vendor CVSS 4.0 vector (9.2, AV:N/AC:L/AT:P/PR:N/UI:N with VC:H/VI:H/VA:H) presents this as a critical, network-reachable, unauthenticated SQL injection with full CIA impact scaled to the database account's privileges (CWE-89). The single most important nuance is the AT:P (Attack Requirements: Present) metric, which the vendor correctly set: this is NOT a flaw that fires against a default CakePHP application. Exploitation requires the *application developer* to have passed untrusted, user-controlled input directly into the dataType/part/unit structural parameters of FunctionsBuilder::cast/extract/datePart/dateAdd - parameters documented and typed as trusted structural strings, not data slots. The source diff confirms the framework never bound these values; it spliced them raw into SQL, and the fix (ensureSimpleString enforcing ^[a-zA-Z0-9]+$) is a framework-side hardening of a developer-misuse surface. No EPSS score, KEV listing, or public POC is present in the supplied intelligence, so the real-world weaponization signal is absent. Bottom line: genuinely high impact where the vulnerable coding pattern exists, but the AT:P gate means this is closer to a widespread latent-misuse defect than a universally exploitable framework hole. Whether a given deployment is exploitable depends entirely on application code, not on running an affected CakePHP version. |
| Exploit ScenarioDerived | A CakePHP application builds a query using FunctionsBuilder::datePart, extract, cast, or dateAdd and passes a request parameter (e.g. a user-selected 'unit' or 'dataType' from a sort/report form) straight into the part/unit/dataType argument. A remote attacker submits a value like "' DROP TABLE users --" (mirroring the test's invalidValues cases), which is concatenated unescaped into the SQL as a structural fragment, achieving injection with read/write/DoS impact limited only by the DB connection's privileges. No public exploit code is identified in the provided data, though the fix commits and PRs are public and clearly show the vulnerable sink. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
SQL injection in the CakePHP PHP framework (versions prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7) allows unauthenticated remote attackers to inject arbitrary SQL when an application forwards untrusted input into the $dataType, $part, or $unit arguments of FunctionsBuilder::cast, ::extract, ::datePart, and ::dateAdd, which the framework incorporates into generated SQL as unescaped structural fragments rather than bound parameters. Successful exploitation yields high confidentiality, integrity, and availability impact bounded by the privileges of the application's database connection, as reflected in the vendor's CVSS 4.0 score of 9.2 (CWE-89); however, the attack requires the non-default precondition that the application itself passes attacker-controllable data to these trusted-structure parameters, which is not an idiomatic usage pattern. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, though the framework's broad deployment makes prompt patching advisable.
RemediationAI
Vendor-released patches: upgrade to CakePHP 4.5.12, 4.6.5, 5.1.9, 5.2.14, or 5.3.7 depending on your maintained branch (release links: https://github.com/cakephp/cakephp/releases/tag/4.5.12, /4.6.5, /5.1.9, /5.2.14, /5.3.7; advisory: https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf). The fix adds an ensureSimpleString() guard in src/Database/FunctionsBuilder.php that throws InvalidArgumentException unless dataType, part, and unit match ^[a-zA-Z0-9]+$, so upgrade is effective regardless of how the application calls these methods. Where upgrading is not immediately possible, audit all call sites of FunctionsBuilder::cast(), ::extract(), ::datePart(), and ::dateAdd() and replace any user-influenced value in the $dataType, $part, or $unit positions with a fixed allow-list of literal constants (for example, mapping an expected set of values such as 'year', 'month', 'day', or 'integer' to hard-coded strings before the call); the trade-off is that legitimate dynamic formatting choices must be constrained to that allow-list, but this removes the injection primitive entirely. As a compensating control, review the database user's privileges - revoking DDL, cross-schema, and file-system rights limits the blast radius of any residual injection, since impact is bounded by the connection's grants - and consider a WAF rule rejecting SQL metacharacters (quotes, comment sequences, whitespace) in requests that reach these code paths. Note that simply escaping input at the application layer is not a reliable fix here because these arguments become query structure rather than values.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CakePHP is a widely used rapid-development MVC framework for PHP, and its Database layer (src/Database/FunctionsBuilder.php) constructs SQL function expressions such as CAST, EXTRACT, DATEPART, and DATEADD for the query builder. In the vulnerable builds, the dataType, part, and unit parameters are typed and documented as trusted structural strings (ExpressionInterface|string) and are concatenated directly into the emitted SQL rather than being escaped or passed as bound parameters - a classic CWE-89 improper neutralization of special elements used in an SQL command, where the defect is the absence of input validation on what the code treats as query structure. The upstream fix (GitHub pull requests 19520 and 19528, commits 3349584ca3a891afaff2dbc324d6b1c09fb880f0, 3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e, 79e1d6bc6f3a50fa01805579076a02c77370c676, 8699d6f38e25fe46fcc24f2b698809948e71ad7d, and ab608711674ac662af7315c5cdf1e0fbe2000e45) introduces a protected ensureSimpleString() helper that rejects any value failing the '/^[a-zA-Z0-9]+$/' alphanumeric pattern by throwing InvalidArgumentException, and additionally tightens the docblocks across the builder to warn that ExpressionInterface|string parameters are unsafe for user-controlled data. The CPE cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* reflects that the advisory applies across the whole framework package rather than a single component.
Know when Cakephp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network, unauthenticated, full CIA per DB privileges; AC:H maps the vendor's AT:P gate because exploitation depends on the application feeding untrusted input into trusted structural parameters.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Technical POC Analysis
CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Organizations running PHP applications built on the CakePHP framework at versions below 4.5.12, 4.6.5, 5.1.9, 5.2.14, or 5.3.7 carry a critical SQL injection exposure in the framework's SQL-function builder, where four structural argument types are concatenated into generated SQL rather than bound as parameters. Because CakePHP is a widely embedded dependency, the exposure reaches any downstream application whose own code forwards user-controllable values into those arguments - an uncommon but not impossible pattern - and where it occurs, the database connection's full privileges are available to an attacker, affecting confidentiality, integrity, and availability of the data behind that application. Leadership should treat this as a portfolio-wide dependency hygiene issue: no public exploit was identified at time of analysis and the issue is not in CISA KEV, but the breadth of deployment means the inventory and code-review work is significant even though the per-application likelihood of the unsafe pattern is low.
Apply vendor patch (upgrade to 4.5.12, 4.6.5, 5.1.9, 5.2.14, or 5.3.7) as the primary remediation; if immediate upgrade is not achievable, apply strict server-side allowlisting so only hard-coded, developer-controlled constants can reach the $dataType, $part, and $unit arguments; run affected applications under a database account limited to the minimum required privileges, avoiding schema-altering or administrative rights; deploy WAF/virtual-patching rules targeting SQL-injection patterns against routes that expose date or cast functionality; and enable database query logging and anomaly alerting to detect structural SQL manipulation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via X
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP head
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method pa
CakePHP is a development framework for PHP web apps. Rated critical severity (CVSS 9.8), this vulnerability is remotely
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBui
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, a
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMT
An issue was discovered in SmtpTransport in CakePHP 3.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotel
Local file inclusion in CakePHP's View::_getElementFileName() allows remote attackers to include arbitrary PHP files fro
CakePHP versions prior to 5.2.12 and 5.3.1 contain a stored cross-site scripting vulnerability in the PaginatorHelper::l
CakePHP before 4.0.6 mishandles CSRF token generation. Rated medium severity (CVSS 4.3), this vulnerability is remotely
Exploit-DB