CVE-2026-79752 in CakePHP
Summary
by MITRE • 09/17/2026
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The CakePHP framework provides a suite of database abstraction tools designed to simplify SQL query construction for PHP developers. Among these utilities is the FunctionsBuilder class, which offers methods such as cast, extract, datePart, and dateAdd to generate specific SQL function calls dynamically. These functions are intended to allow developers to construct complex queries by passing parameters like data types, date parts, or time units into helper methods that format them correctly for inclusion in a query string. The security architecture of these components relies on the assumption that such structural elements remain trusted and static, as they directly influence the syntax structure of the resulting SQL statement rather than just its payload values.
A critical vulnerability exists within versions prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7 where these methods fail to adequately validate or sanitize user-controlled input before incorporating it into the SQL structure. Specifically, when an application passes untrusted data as arguments for dataType, part, or unit parameters, the FunctionsBuilder class embeds this raw input directly into the generated SQL string without escaping or restricting allowed values. This lack of validation allows an attacker to inject arbitrary SQL syntax fragments that alter the intended logic of the query. Because these inputs affect structural components rather than simple data bindings, standard parameterized queries cannot mitigate this flaw if the developer relies on these helper methods for dynamic construction based on user input.
The operational impact of this vulnerability is severe, classified as a Remote Code Execution vector through SQL Injection (CWE-89). An attacker who can control any of these parameters can manipulate the database engine to execute unintended commands. This compromises confidentiality by allowing unauthorized data extraction, integrity by enabling modification or deletion of records, and availability by potentially disrupting service through malformed queries or denial-of-service conditions. The extent of damage is further determined by the privileges assigned to the database connection used by the application, meaning that if the web server runs with high-level database permissions, an attacker could gain full administrative control over the underlying data store.
This vulnerability maps directly to Common Weakness Enumeration identifier CWE-20 Improper Input Validation and ATT&CK technique T1190 Exploit Public-Facing Application. The root cause lies in the failure to enforce a whitelist of acceptable values for structural SQL components, which is a fundamental requirement when building dynamic queries that modify syntax rather than just data content. Developers using CakePHP must recognize that helper methods designed for convenience do not automatically provide security guarantees against injection attacks when fed with external input.
To mitigate this risk, organizations should immediately upgrade to the fixed versions of CakePHP listed above: 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. These releases implement proper validation logic within the FunctionsBuilder methods to ensure that only predefined, safe values are accepted for structural parameters like data types and date parts. For applications unable to upgrade immediately due to legacy constraints, developers should avoid passing user-controlled input directly into these specific functions. Instead, they should manually construct SQL statements using strict whitelisting mechanisms or switch to static query structures where possible, ensuring that no untrusted data influences the syntactic structure of database commands.