Database Query::offset() and limit() vulnerable to SQL injection in cakephp
Priority MEDIUM 51CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00898 59th percentileScored 2026-11-07
Fix Fixed cakephp (cakephp): 4.2.12, 4.3.11, 4.4.10cakephp/cakephp (Packagist): 4.2.12, 4.3.11, 4.4.10+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cakephp | cakephp | 4.2.0 to before 4.2.12; 4.3.0 to before 4.3.11; 4.4.0 to before 4.4.10 | 4.2.12, 4.3.11, 4.4.10 | Patch available | CNA |
| — | cakephp/cakephp (Packagist) | 4.2.0 to before 4.2.12 | 4.2.12 | Patch available | GHSA-6g8q-qfpv-57wp |
| — | cakephp/cakephp (Packagist) | 4.3.0 to before 4.3.11 | 4.3.11 | Patch available | GHSA-6g8q-qfpv-57wp |
| — | cakephp/cakephp (Packagist) | 4.4.0 to before 4.4.10 | 4.4.10 | Patch available | GHSA-6g8q-qfpv-57wp |
| — | cakephp/database (Packagist) | 4.2.0 to before 4.2.12 | 4.2.12 | Patch available | GHSA-6g8q-qfpv-57wp |
| — | cakephp/database (Packagist) | 4.3.0 to before 4.3.11 | 4.3.11 | Patch available | GHSA-6g8q-qfpv-57wp |
| — | cakephp/database (Packagist) | 4.4.0 to before 4.4.10 | 4.4.10 | Patch available | GHSA-6g8q-qfpv-57wp |
- cakephp Vendorcakephp Affected 4.2.0 to before 4.2.12; 4.3.0 to before 4.3.11; 4.4.0 to before 4.4.10 Fixed in 4.2.12, 4.3.11, 4.4.10 Patch available CNA
- cakephp/cakephp (Packagist) Vendor— Affected 4.2.0 to before 4.2.12 Fixed in 4.2.12 Patch available GHSA-6g8q-qfpv-57wp
- cakephp/cakephp (Packagist) Vendor— Affected 4.3.0 to before 4.3.11 Fixed in 4.3.11 Patch available GHSA-6g8q-qfpv-57wp
- cakephp/cakephp (Packagist) Vendor— Affected 4.4.0 to before 4.4.10 Fixed in 4.4.10 Patch available GHSA-6g8q-qfpv-57wp
- cakephp/database (Packagist) Vendor— Affected 4.2.0 to before 4.2.12 Fixed in 4.2.12 Patch available GHSA-6g8q-qfpv-57wp
- cakephp/database (Packagist) Vendor— Affected 4.3.0 to before 4.3.11 Fixed in 4.3.11 Patch available GHSA-6g8q-qfpv-57wp
- cakephp/database (Packagist) Vendor— Affected 4.4.0 to before 4.4.10 Fixed in 4.4.10 Patch available GHSA-6g8q-qfpv-57wp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* | 4.2.0 to before 4.2.12; 4.3.0 to before 4.3.11; 4.4.0 to before 4.4.10 | Vulnerable | cakephp |
- cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.2.12; 4.3.0 to before 4.3.11; 4.4.0 to before 4.4.10 Vulnerable ·cakephp
Remediation
- Fix · CNA cakephp (cakephp) Fixed in 4.2.12, 4.3.11, 4.4.10
- Fix · GHSA-6g8q-qfpv-57wp cakephp/cakephp (Packagist) Fixed in 4.2.12 Advisory →
- Fix · GHSA-6g8q-qfpv-57wp cakephp/cakephp (Packagist) Fixed in 4.3.11 Advisory →
- Fix · GHSA-6g8q-qfpv-57wp cakephp/cakephp (Packagist) Fixed in 4.4.10 Advisory →
- Fix · GHSA-6g8q-qfpv-57wp cakephp/database (Packagist) Fixed in 4.2.12 Advisory →
- Fix · GHSA-6g8q-qfpv-57wp cakephp/database (Packagist) Fixed in 4.3.11 Advisory →
- Fix · GHSA-6g8q-qfpv-57wp cakephp/database (Packagist) Fixed in 4.4.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22727
- 2026-10-03 Alias added: GHSA-6g8q-qfpv-57wp
References
Advisory 3
More Cakephp vulnerabilities
- TI-2010-04068 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… CVSS 2.0HIGH 7.5
- TI-2026-19037 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVSS 3.1MEDIUM 5.4
- TI-2016-04142 The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their… CVSS 3.0HIGH 7.5
- TI-2015-06899 CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF… CVSS 3.0HIGH 8.8
- TI-2020-17913 A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. CVSS 3.1HIGH 8.8
- TI-2019-08553 An issue was discovered in SmtpTransport in CakePHP 3.7.6. CVSS 3.0HIGH 7.5
Sources
- CVE-2023-22727 · CVE Program
- CVE-2023-22727 · NVD
- FIRST EPSS
- GHSA-6g8q-qfpv-57wp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences