GitHub Advisoryadvisory · Packagist

GHSA-6g8q-qfpv-57wp CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection

CRITICAL Published 2023-01-20 Modified 2023-01-25 Official page ↗
Aliases
CVE-2023-22727
Ecosystem
Packagist
Packages
cakephp/cakephp, cakephp/database
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-01-20

Affected packages

• Packagist cakephp/cakephp: >= 4.2.0, < 4.2.12 → fixed in 4.2.12 • Packagist cakephp/cakephp: >= 4.3.0, < 4.3.11 → fixed in 4.3.11 • Packagist cakephp/cakephp: >= 4.4.0, < 4.4.10 → fixed in 4.4.10 • Packagist cakephp/database: >= 4.2.0, < 4.2.12 → fixed in 4.2.12 • Packagist cakephp/database: >= 4.3.0, < 4.3.11 → fixed in 4.3.11 • Packagist cakephp/database: >= 4.4.0, < 4.4.10 → fixed in 4.4.10

Description

Impact The `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. Patches This issue has been fixed in 4.2.12, 4.3.11, 4.4.10 Workarounds Using CakePHP's Pagination library will mitigate this issue, as will validating or casting parameters to these methods. References https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html

Related

Alias · CVE (1)

  • CVE-2023-22727 CakePHP is a development framework for PHP web apps. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References