abraxas/cve-2026-79752Paquete de divulgación de CVE-2026-79752 para la inyección SQL de CakePHP 5.2.13 a través de FunctionsBuilder::cast, con un script PoC en Python y un laboratorio Docker para su reproducción autorizada.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-79752
CakePHP 5.2.13 — cakephp
CakePHP es un framework de desarrollo rápido para PHP. Antes de 4.5.12, 4.6.5, 5.1.9, 5.2.14 y 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart y FunctionsBuilder::dateAdd en src/Database/FunctionsBuilder.php aceptan valores de dataType, part o unit controlados por el usuario y los incorporan al SQL generado como fragmentos estructurales sin escapar. Una aplicación que pasa entrada no confiable a estos parámetros puede permitir inyección SQL con impacto en confidencialidad, integridad y disponibilidad según los privilegios de la conexión a la base de datos. Este problema está corregido en las versiones 4.5.12, 4.6.5, 5.1.9, 5.2.14 y 5.3.7.
| CVE | CVE-2026-79752 · CVE.org |
| CWE | CWE-89 |
| CVSS | Crítico: 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Producto | CakePHP |
| Afectado | 5.2.x hasta 5.2.13 (también 4.5.x < 4.5.12, 4.6.x < 4.6.5, 5.1.x < 5.1.9, 5.3.x < 5.3.7) |
| Parcheado | 5.2.14, 5.3.7, 5.1.9, 4.6.5, 4.5.12 |
| Auth | ninguna (ver mapa de origen) |
| Licencia | GNU Affero GPL v3.0 |
| Lab | solo 127.0.0.1 · paquete de divulgación para el proveedor/cliente, no un escáner |
cast() $dataType es el sink. HTTP es GET /?type= en la app del lab, no una ruta de WP.
GET/?type=GET /?type=<tipo SQL inyectado>FunctionsBuilder::cast inserta el tipo como literalSQLite ejecuta CAST(body AS ...)notes.body POCWitness79752 en el cuerpo HTTPPOCWitness79752 en el cuerpo HTTP Y la línea sql= muestra el fragmento inyectado (no solo CAST(body AS TEXT)).
Haz esto primero: Actualiza CakePHP a 5.2.14 (o 5.3.7 / 5.1.9 / 4.6.5 / 4.5.12). Aviso: GHSA-vjqc-q4mp-2rvf.
Verificar tras la actualización
CVE-2026-79752-Abraxas-Labs.py contra la compilación parcheada: el testigo mapeado no debe aparecer.Si no puedes actualizar de inmediato
Objetivo solo http://127.0.0.1:8088 (o el loopback que hayas vinculado). No apuntes este script a internet.
python3 CVE-2026-79752-Abraxas-Labs.py
El éxito es el testigo anterior en el cuerpo de la respuesta. Un 200 HTML genérico no lo es.
Stack de loopback usado para reproducir. Imágenes oficiales a menos que un Dockerfile en esta carpeta compile desde el código fuente.
cd lab
docker compose up --force-recreate
Vincula el árbol del producto vulnerable junto a Compose si el YAML monta un directorio local (zip del plugin / etiqueta de código fuente de la tabla de versiones). No publiques nada excepto 127.0.0.1.
github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-79752 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-79752`
- CWE: CWE-89
- published: 2026-09-17T15:16:51.673
## NVD description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
## MITRE description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
## Affected
- cakephp cakephp < 4.5.12 affected, >= 4.6.0, < 4.6.5 affected, >= 5.0.0, < 5.1.9 affected, >= 5.2.0, < 5.2.14 affected, >= 5.3.0, < 5.3.7 affected
- OSV:
## References (JSON sources only)
- https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
- https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
- https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
- https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
- https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
- https://github.com/cakephp/cakephp/pull/19520
- https://github.com/cakephp/cakephp/pull/19528
- https://github.com/cakephp/cakephp/releases/tag/4.5.12
- https://github.com/cakephp/cakephp/releases/tag/4.6.5
- https://github.com/cakephp/cakephp/releases/tag/5.1.9
- https://github.com/cakephp/cakephp/releases/tag/5.2.14
- https://github.com/cakephp/cakephp/releases/tag/5.3.7
- https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-79752
- https://github.com/advisories/GHSA-vjqc-q4mp-2rvf
- https://github.com/cakephp/cakephp/releases/tag/5.1.8
## GitHub advisory
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
### Impact
The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
### Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
### Workarounds
Don't provide user controlled data to these functions/parameters.
## OSV
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed i
Este paquete de divulgación está licenciado bajo la GNU Affero General Public License v3.0. Ver LICENSE.
Este paquete es para el proveedor, el propietario del sitio y labs autorizados. El script se comunica con 127.0.0.1. Usarlo contra sistemas que no posees no está autorizado por Abraxas Labs. Sin garantía.