Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-79752— CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Quick assessment

Affected
cakephp cakephp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CakePHP 是一个用于 PHP 的 rapid development（快速开发）框架。在 4.5.12、4.6.5、5.1.9、5.2.14 和 5.3.7 之前版本中， 文件中的 、 、 和 函数接受用户可控的 、 或 参数，并将这些值作为未转义的结构化片段直接拼接到生成的 SQL 语句中。如果应用程序将这些参数传入不受信任的用户输入，则可能导致 SQL 注入漏洞，其影响范围取决于数据库连接所具有的权限，可能危及数据的机密性、完整性和可用性。该问题已在 4.5.12、4.6.5、5.1.9、5.2.14 和

CVSS 9.2 · Critical

Possible ATT&CK Techniques 1 AI

T1212.001
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-79752

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
Source: CVE Program / CVE List V5
Vulnerability Description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cakephp cakephp < 4.5.12 -

II. Public POCs for CVE-2026-79752

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-79752

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-79752 (7)

Vendor Advisories for CVE-2026-79752 (1)

Vendor Pages for CVE-2026-79752 (5)

IV. Related Vulnerabilities

Same product: cakephp
Same vendor: cakephp
Same weakness: CWE-89

V. Comments for CVE-2026-79752

No comments yet

Leave a comment