abraxas/cve-2026-79752Pacchetto di divulgazione CVE-2026-79752 per l'iniezione SQL in CakePHP 5.2.13 tramite FunctionsBuilder::cast, con uno script PoC in Python e un laboratorio Docker per la riproduzione autorizzata.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-79752
CakePHP 5.2.13 — cakephp
CakePHP è un framework per lo sviluppo rapido di applicazioni PHP. Prima delle versioni 4.5.12, 4.6.5, 5.1.9, 5.2.14 e 5.3.7, i metodi FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart e FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accettano valori dataType, part o unit controllati dall'utente e li incorporano nell'SQL generato come frammenti strutturali non sottoposti a escaping. Un'applicazione che passa input non attendibile a questi parametri può consentire SQL injection con impatto su riservatezza, integrità e disponibilità in base ai privilegi della connessione al database. Il problema è risolto nelle versioni 4.5.12, 4.6.5, 5.1.9, 5.2.14 e 5.3.7.
| CVE | CVE-2026-79752 · CVE.org |
| CWE | CWE-89 |
| CVSS | Critico: 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Prodotto | CakePHP |
| Affetto | 5.2.x fino alla 5.2.13 (anche 4.5.x < 4.5.12, 4.6.x < 4.6.5, 5.1.x < 5.1.9, 5.3.x < 5.3.7) |
| Corretto | 5.2.14, 5.3.7, 5.1.9, 4.6.5, 4.5.12 |
| Auth | nessuna (vedi source map) |
| Licenza | GNU Affero GPL v3.0 |
| Lab | solo 127.0.0.1 · pacchetto di divulgazione per vendor/client, non uno scanner |
cast() $dataType è il sink. HTTP è GET /?type= sull'app del lab, non una route WP.
GET/?type=GET /?type=<tipo SQL iniettato>FunctionsBuilder::cast inserisce il tipo come literalSQLite esegue CAST(body AS ...)notes.body POCWitness79752 nel body HTTPPOCWitness79752 nel body HTTP E la riga sql= mostra il frammento iniettato (non solo CAST(body AS TEXT)).
Fai questo per primo: Aggiorna CakePHP alla 5.2.14 (o 5.3.7 / 5.1.9 / 4.6.5 / 4.5.12). Advisory: GHSA-vjqc-q4mp-2rvf.
Verifica dopo l'aggiornamento
CVE-2026-79752-Abraxas-Labs.py contro la build corretta: il witness mappato non deve comparire.Se non puoi aggiornare immediatamente
Prendi di mira solo http://127.0.0.1:8088 (o il loopback su cui hai fatto il bind). Non puntare questo script verso Internet.
python3 CVE-2026-79752-Abraxas-Labs.py
Il successo è il witness sopra nel body della risposta. Un generico 200 HTML non lo è.
Stack loopback usato per la riproduzione. Immagini ufficiali a meno che un Dockerfile in questa cartella non venga compilato dai sorgenti.
cd lab
docker compose up --force-recreate
Collega l'albero del prodotto vulnerabile accanto a Compose se lo YAML monta una directory locale (zip del plugin / tag sorgente dalla tabella delle versioni). Non pubblicare nulla tranne 127.0.0.1.
github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-79752 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-79752`
- CWE: CWE-89
- published: 2026-09-17T15:16:51.673
## NVD description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
## MITRE description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
## Affected
- cakephp cakephp < 4.5.12 affected, >= 4.6.0, < 4.6.5 affected, >= 5.0.0, < 5.1.9 affected, >= 5.2.0, < 5.2.14 affected, >= 5.3.0, < 5.3.7 affected
- OSV:
## References (JSON sources only)
- https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
- https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
- https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
- https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
- https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
- https://github.com/cakephp/cakephp/pull/19520
- https://github.com/cakephp/cakephp/pull/19528
- https://github.com/cakephp/cakephp/releases/tag/4.5.12
- https://github.com/cakephp/cakephp/releases/tag/4.6.5
- https://github.com/cakephp/cakephp/releases/tag/5.1.9
- https://github.com/cakephp/cakephp/releases/tag/5.2.14
- https://github.com/cakephp/cakephp/releases/tag/5.3.7
- https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-79752
- https://github.com/advisories/GHSA-vjqc-q4mp-2rvf
- https://github.com/cakephp/cakephp/releases/tag/5.1.8
## GitHub advisory
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
### Impact
The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
### Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
### Workarounds
Don't provide user controlled data to these functions/parameters.
## OSV
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed i
Questo pacchetto di divulgazione è rilasciato sotto GNU Affero General Public License v3.0. Vedi LICENSE.
Questo pacchetto è destinato al vendor, al proprietario del sito e ai lab autorizzati. Lo script comunica con 127.0.0.1. L'uso contro sistemi di cui non sei proprietario non è autorizzato da Abraxas Labs. Nessuna garanzia.