Cakephp Database
Monthly
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBuilder::jsonValue() with the PostgreSQL driver and passes user-controlled data into the jsonPath parameter. Affected release lines are 5.1.x before 5.1.10, 5.2.x before 5.2.15, and 5.3.x before 5.3.7; the root cause is the jsonPath value being interpolated into the generated ::jsonpath expression rather than bound as a parameter. No public exploit identified at time of analysis (not listed in CISA KEV), though the fix commit includes a regression test containing a working injection string.
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBuilder::jsonValue() with the PostgreSQL driver and passes user-controlled data into the jsonPath parameter. Affected release lines are 5.1.x before 5.1.10, 5.2.x before 5.2.15, and 5.3.x before 5.3.7; the root cause is the jsonPath value being interpolated into the generated ::jsonpath expression rather than bound as a parameter. No public exploit identified at time of analysis (not listed in CISA KEV), though the fix commit includes a regression test containing a working injection string.