Headline
CVE-2023-22727: CakePHP 4.2.11, 4.3.11, and 4.4.10 Released — Bakery
CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP’s Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
January 06, 2023
The CakePHP core team is happy to announce the immediate availability of CakePHP 4.2.11, 4.3.11, and 4.4.10. These releases contain a security fix for the limit() and offset() methods of Cake\Database\Query. If passed unfiltered request data, these methods would allow for SQL injection. If your application does not use CakePHP’s Pagination wrappers and directly passes request data into one of these methods your application is vulnerable. We’d like to thank ‘Tanaka’ for reporting this issue.
Additional Bugfixes in 4.4.10
The 4.4.10 release contains the aforementioned security fix as well as the following fixes. See the changelog for every commit.
- Update association definitions in ORM tests.
- Update build images to Ubuntu 22.04.
Contributors to 4.4.10
Thank you to all the contributors that helped make this release happen:
- ADmad
- Kevin Pfeifer
- Mark Scherer
- Mark Story
- othercorey
As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.
Download a packaged release on github.
Related news
### Impact The `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. ### Patches This issue has been fixed in 4.2.12, 4.3.11, 4.4.10 ### Workarounds Using CakePHP's Pagination library will mitigate this issue, as will validating or casting parameters to these methods. ### References https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html