PT-2026-94368

CVE-2026-79752

تاريخ النشر

2026-09-17

تاريخ التحديث

2026-09-19

الوصف من

CVSS 4.0

9.2

حرجة

المقاييسAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 4.5.12 CakePHP versions prior to 4.6.5 CakePHP versions prior to 5.1.9 CakePHP versions prior to 5.2.14 CakePHP versions prior to 5.3.7

Description Certain methods in src/Database/FunctionsBuilder.php allow user-controlled values to be incorporated into generated SQL as unescaped structural fragments. This can lead to SQL injection, impacting confidentiality, integrity, and availability based on the database connection privileges. The affected functions and their vulnerable parameters are:

FunctionsBuilder::cast(): dataType
FunctionsBuilder::extract(): part
FunctionsBuilder::datePart(): part
FunctionsBuilder::dateAdd(): unit

Recommendations Update to version 4.5.12 Update to version 4.6.5 Update to version 5.1.9 Update to version 5.2.14 Update to version 5.3.7 Avoid providing user-controlled data to the dataType, part, and unit parameters of the affected functions.

قابلية الاستغلال

استغلال

إصلاح

التأثيرات

الباحثون

Unknownhad

المورّدون

المنتجات المتأثرة

تصنيف نقاط الضعف

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

المعرّفات ذات الصلة

CVE-2026-79752