CVE-2026-79752

CakePHP 5.2.13 — cakephp

CakePHP, PHP के लिए एक तेज़ विकास फ्रेमवर्क है। 4.5.12, 4.6.5, 5.1.9, 5.2.14 और 5.3.7 से पहले, src/Database/FunctionsBuilder.php में FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart और FunctionsBuilder::dateAdd उपयोगकर्ता-नियंत्रित dataType, part या unit मान स्वीकार करते हैं और उन्हें बिना escape किए संरचनात्मक अंशों के रूप में उत्पन्न SQL में शामिल करते हैं। जो एप्लिकेशन इन पैरामीटरों को अविश्वसनीय इनपुट देता है, वह डेटाबेस कनेक्शन के विशेषाधिकारों के अनुसार गोपनीयता, अखंडता और उपलब्धता प्रभाव के साथ SQL इंजेक्शन की अनुमति दे सकता है। यह समस्या संस्करण 4.5.12, 4.6.5, 5.1.9, 5.2.14 और 5.3.7 में ठीक की गई है।

# CVE-2026-79752 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-79752` - CWE: CWE-89 - published: 2026-09-17T15:16:51.673 ## NVD description CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. ## MITRE description CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. ## Affected - cakephp cakephp < 4.5.12 affected, >= 4.6.0, < 4.6.5 affected, >= 5.0.0, < 5.1.9 affected, >= 5.2.0, < 5.2.14 affected, >= 5.3.0, < 5.3.7 affected - OSV: ## References (JSON sources only) - https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0 - https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e - https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676 - https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d - https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45 - https://github.com/cakephp/cakephp/pull/19520 - https://github.com/cakephp/cakephp/pull/19528 - https://github.com/cakephp/cakephp/releases/tag/4.5.12 - https://github.com/cakephp/cakephp/releases/tag/4.6.5 - https://github.com/cakephp/cakephp/releases/tag/5.1.9 - https://github.com/cakephp/cakephp/releases/tag/5.2.14 - https://github.com/cakephp/cakephp/releases/tag/5.3.7 - https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json - https://nvd.nist.gov/vuln/detail/CVE-2026-79752 - https://github.com/advisories/GHSA-vjqc-q4mp-2rvf - https://github.com/cakephp/cakephp/releases/tag/5.1.8 ## GitHub advisory CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection ### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters. ### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes ### Workarounds Don't provide user controlled data to these functions/parameters. ## OSV CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed i

CVE	CVE-2026-79752 · CVE.org
CWE	CWE-89
CVSS	Critical: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
Product	CakePHP
Affected	5.2.x through 5.2.13 (also 4.5.x < 4.5.12, 4.6.x < 4.6.5, 5.1.x < 5.1.9, 5.3.x < 5.3.7)
Patched	5.2.14, 5.3.7, 5.1.9, 4.6.5, 4.5.12
Auth	none (see source map)
License	GNU Affero GPL v3.0
Lab	`127.0.0.1` only · vendor/client disclosure pack, not a scanner

CVE-2026-79752

सबसे लोकप्रिय

Advisory (from the source map)

Entry

Call chain

Lab preconditions

Witness

Not success

Patch / remediation

Reproduction (authorized lab)

Lab images

References

Records (structured)

License

Disclaimer