abraxas/cve-2026-79752Pacote de divulgação da CVE-2026-79752 para injeção SQL no CakePHP 5.2.13 via FunctionsBuilder::cast, com um script PoC em Python e laboratório Docker para reprodução autorizada.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-79752
CakePHP 5.2.13 — cakephp
CakePHP é um framework de desenvolvimento rápido para PHP. Antes das versões 4.5.12, 4.6.5, 5.1.9, 5.2.14 e 5.3.7, os métodos FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart e FunctionsBuilder::dateAdd em src/Database/FunctionsBuilder.php aceitam valores de dataType, part ou unit controlados pelo usuário e os incorporam ao SQL gerado como fragmentos estruturais não escapados. Uma aplicação que passa entrada não confiável para esses parâmetros pode permitir injeção de SQL com impacto na confidencialidade, integridade e disponibilidade de acordo com os privilégios da conexão com o banco de dados. Esse problema foi corrigido nas versões 4.5.12, 4.6.5, 5.1.9, 5.2.14 e 5.3.7.
| CVE | CVE-2026-79752 · CVE.org |
| CWE | CWE-89 |
| CVSS | Crítico: 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Produto | CakePHP |
| Afetado | 5.2.x até 5.2.13 (também 4.5.x < 4.5.12, 4.6.x < 4.6.5, 5.1.x < 5.1.9, 5.3.x < 5.3.7) |
| Corrigido | 5.2.14, 5.3.7, 5.1.9, 4.6.5, 4.5.12 |
| Autenticação | nenhuma (ver mapa de origem) |
| Licença | GNU Affero GPL v3.0 |
| Lab | apenas 127.0.0.1 · pacote de divulgação para fornecedor/cliente, não é um scanner |
cast() $dataType é o sink. O HTTP é GET /?type= no app do lab, não uma rota do WP.
GET/?type=GET /?type=<tipo SQL injetado>FunctionsBuilder::cast insere o tipo como literalSQLite executa CAST(body AS ...)notes.body POCWitness79752 no corpo HTTPPOCWitness79752 no corpo HTTP E a linha sql= mostra o fragmento injetado (não apenas CAST(body AS TEXT)).
Faça isto primeiro: Atualize o CakePHP para 5.2.14 (ou 5.3.7 / 5.1.9 / 4.6.5 / 4.5.12). Aviso: GHSA-vjqc-q4mp-2rvf.
Verifique após a atualização
CVE-2026-79752-Abraxas-Labs.py contra a build corrigida: o witness mapeado não deve aparecer.Se você não puder atualizar imediatamente
Alvo apenas http://127.0.0.1:8088 (ou o loopback que você vinculou). Não aponte este script para a internet.
python3 CVE-2026-79752-Abraxas-Labs.py
Sucesso é o witness acima no corpo da resposta. Um HTML 200 genérico não é isso.
Stack de loopback usada para reproduzir. Imagens oficiais, a menos que um Dockerfile nesta pasta faça build a partir do código-fonte.
cd lab
docker compose up --force-recreate
Vincule a árvore do produto vulnerável ao lado do Compose se o YAML montar um diretório local (zip do plugin / tag de origem da tabela de versões). Não publique nada exceto 127.0.0.1.
github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-79752 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-79752`
- CWE: CWE-89
- published: 2026-09-17T15:16:51.673
## NVD description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
## MITRE description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
## Affected
- cakephp cakephp < 4.5.12 affected, >= 4.6.0, < 4.6.5 affected, >= 5.0.0, < 5.1.9 affected, >= 5.2.0, < 5.2.14 affected, >= 5.3.0, < 5.3.7 affected
- OSV:
## References (JSON sources only)
- https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
- https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
- https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
- https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
- https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
- https://github.com/cakephp/cakephp/pull/19520
- https://github.com/cakephp/cakephp/pull/19528
- https://github.com/cakephp/cakephp/releases/tag/4.5.12
- https://github.com/cakephp/cakephp/releases/tag/4.6.5
- https://github.com/cakephp/cakephp/releases/tag/5.1.9
- https://github.com/cakephp/cakephp/releases/tag/5.2.14
- https://github.com/cakephp/cakephp/releases/tag/5.3.7
- https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-79752
- https://github.com/advisories/GHSA-vjqc-q4mp-2rvf
- https://github.com/cakephp/cakephp/releases/tag/5.1.8
## GitHub advisory
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
### Impact
The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
### Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
### Workarounds
Don't provide user controlled data to these functions/parameters.
## OSV
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed i
Este pacote de divulgação é licenciado sob a GNU Affero General Public License v3.0. Consulte LICENSE.
Este pacote é destinado ao fornecedor, ao proprietário do site e a labs licenciados. O script se comunica com 127.0.0.1. Usá-lo contra sistemas que você não possui não é autorizado pela Abraxas Labs. Sem garantias.