abraxas/cve-2026-77635Disclosure pack e PoC in Python per CVE-2026-77635, un'iniezione SQL non autenticata in jsonValue() di CakePHP con PostgresDriver, incluso un laboratorio Docker in loopback.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-77635
CakePHP 5.2.13 — cakephp
CakePHP è un framework per lo sviluppo rapido in PHP. Prima delle versioni 5.1.10, 5.2.15 e 5.3.7 sulle rispettive linee di rilascio, FunctionsBuilder::jsonValue() con PostgresDriver è vulnerabile a SQL injection quando dati controllati dall'utente vengono forniti al parametro jsonPath. Questo problema è risolto nelle versioni 5.1.10, 5.2.15 e 5.3.7.
| CVE | CVE-2026-77635 · CVE.org |
| CWE | CWE-89 |
| CVSS | Critico: 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
| Prodotto | CakePHP |
| Affetto | 5.2.x fino a 5.2.13 (anche 5.1.x < 5.1.10, 5.3.x < 5.3.7) |
| Corretto | 5.2.15, 5.1.10, 5.3.7 |
| Auth | nessuna (vedi source map) |
| Licenza | GNU Affero GPL v3.0 |
| Lab | solo 127.0.0.1 · pacchetto di disclosure per vendor/client, non uno scanner |
jsonValue $jsonPath è il sink. HTTP è GET /?path= sull'app del lab.
GET/?path=GET /?path=<injected jsonPath>PostgresDriver quoteIdentifier into JSONB_PATH_QUERYSELECT leaks notes.secretPOCWitness77635 nel body HTTP e sql= contiene il frammento iniettato.
Fai questo per primo: Aggiorna CakePHP a 5.2.15 (o 5.1.10 / 5.3.7). Advisory: GHSA-fxf7-vhh8-7vpq.
Verifica dopo l'aggiornamento
CVE-2026-77635-Abraxas-Labs.py contro la build corretta: il witness mappato non deve comparire.Se non puoi aggiornare immediatamente
Target solo http://127.0.0.1:8088 (o il loopback su cui hai fatto il bind). Non puntare questo script verso internet.
python3 CVE-2026-77635-Abraxas-Labs.py
Il successo è il witness sopra nel body della risposta. Un generico 200 HTML non lo è.
Stack loopback usato per la riproduzione. Immagini ufficiali a meno che un Dockerfile in questa cartella non compili dai sorgenti.
cd lab
docker compose up --force-recreate
Collega l'albero del prodotto vulnerabile accanto a Compose se lo YAML monta una directory locale (zip del plugin / tag sorgente dalla tabella delle versioni). Non pubblicare nulla tranne 127.0.0.1.
github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3
github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55
github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq
github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-77635 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-77635`
- CWE: CWE-89
- published: 2026-08-24T21:17:48.457
## NVD description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
## MITRE description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
## Affected
- cakephp cakephp >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected
- cakephp cakephp/database >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected
- OSV:
## References (JSON sources only)
- https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3
- https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55
- https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
- https://github.com/cakephp/cakephp/releases/tag/5.1.10
- https://github.com/cakephp/cakephp/releases/tag/5.2.15
- https://github.com/cakephp/cakephp/releases/tag/5.3.7
- https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-77635
- https://github.com/advisories/GHSA-fxf7-vhh8-7vpq
## GitHub advisory
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
### Impact
The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter.
### Patches
5.1.10, 5.2.15, 5.3.7
### Workarounds
Don't provide user controlled data to these functions/parameters.
## OSV
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Questo pacchetto di disclosure è rilasciato sotto GNU Affero General Public License v3.0. Vedi LICENSE.
Questo pacchetto è destinato al vendor, al proprietario del sito e ai lab autorizzati. Lo script comunica con 127.0.0.1. Usarlo contro sistemi di cui non sei proprietario non è autorizzato da Abraxas Labs. Nessuna garanzia.