GHSA-vjqc-q4mp-2rvf: SQL Injection
Impact The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds Don't provide user controlled data to these functions/parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.3.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.2.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.1.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.5.12 - Configuration
Ensure user-controlled data is not supplied to `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, and `dateAdd($expr, $value, $unit)`—specifically prevent user control of `$dataType`, `$part`, and `$unit` (and `$expr` where applicable).
SQL query building / methods in `FunctionsBuilder` Input validation for parameters = No user-controlled data
Event History
Frequently Asked Questions
Which applications are exposed to this SQL injection issue?
Applications using composer/cakephp/cakephp or composer/cakephp/database are exposed when they pass user-controlled values as the data type, date part, or date-add unit arguments to the affected FunctionsBuilder methods.
What does an attacker need to exploit it?
An attacker needs influence over the $dataType argument of cast(), the $part argument of extract() or datePart(), or the $unit argument of dateAdd(). The issue is specifically tied to user-controlled data reaching those parameters.
Which versions contain fixes?
Fixes are available in versions 5.3.7, 5.2.14, 5.1.9, 4.6.5, and 4.5.12.
What can be done if upgrading is not immediately possible?
Do not provide user-controlled data to the affected dataType, part, or unit parameters. Ensure these arguments are selected from application-controlled values rather than directly derived from requests or other untrusted input.