Executive brief
CakePHP is a popular web application framework used to build PHP-based websites and applications. Multiple query-building methods in the framework fail to properly sanitize user-supplied parameters, allowing an attacker to inject malicious SQL commands. If an application uses these methods with untrusted input, an attacker could read, modify, or delete sensitive database records.
Technical details
The FunctionsBuilder class in CakePHP contains SQL injection vulnerabilities in the cast(), extract(), datePart(), and dateAdd() methods when user-controlled data is passed to the $dataType, $part, or $unit parameters. The root cause is insufficient input validation or parameterization of these parameters before they are incorporated into SQL queries. An attacker with network access to an application using these methods with untrusted input can inject arbitrary SQL through these parameters without requiring prior authentication. Successful exploitation allows reading, modifying, or deleting database records and potentially executing operating system commands depending on database privileges. Patches are available in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Affected products
- CakePHP CakePHP < 4.5.12, >= 4.6.0 and < 4.6.5, >= 5.0.0 and < 5.1.9, >= 5.2.0 and < 5.2.14, >= 5.3.0 and < 5.3.7
- CakePHP Database >= 3.0.0 and < 4.5.12, >= 4.6.0 and < 4.6.5, >= 5.0.0 and < 5.1.9, >= 5.2.0 and < 5.2.14, >= 5.3.0 and < 5.3.7
Timeline
- 2026-09-17: disclosed: Published to GitHub Advisory Database
- 2026-09-17: patched: Fixes available in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7