GHSA-vjqc-q4mp-2rvf CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

• Packagist cakephp/database: >= 3.0.0, < 4.5.12 → fixed in 4.5.12 • Packagist cakephp/database: >= 4.6.0, < 4.6.5 → fixed in 4.6.5 • Packagist cakephp/database: >= 5.0.0, < 5.1.9 → fixed in 5.1.9 • Packagist cakephp/database: >= 5.2.0, < 5.2.14 → fixed in 5.2.14 • Packagist cakephp/database: >= 5.3.0, < 5.3.7 → fixed in 5.3.7 • Packagist cakephp/cakephp: < 4.5.12 → fixed in 4.5.12 • Packagist cakephp/cakephp: >= 4.6.0, < 4.6.5 → fixed in 4.6.5 • Packagist cakephp/cakephp: >= 5.0.0, < 5.1.9 → fixed in 5.1.9 • Packagist cakephp/cakephp: >= 5.2.0, < 5.2.14 → fixed in 5.2.14 • Packagist cakephp/cakephp: >= 5.3.0, < 5.3.7 → fixed in 5.3.7

Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes Workarounds Don't provide user controlled data to these functions/parameters.