CVE-2026-119419
Mở trang đầy đủCVSS 8.1 HIGH Lộ dữ liệu
CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
Mô tả
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
Điểm và phân loại
- CVSS
- 8.1 HIGH v3.1
- Nguồn điểm
- NVD
- Mức độ (theo nguồn)
- HIGH
- EPSS
- —
- CWE
- CWE-89
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Ảnh hưởng
Sản phẩm
- cakephp cakephp
Vì sao được giữ
- CVSS 8.1 >= 8.0
Loại tác động
- Lộ dữ liệu
- CWE-89; từ khoá "sql injection"
Dữ liệu riêng của nguồn
- CVE.org · Đơn vị cấp mã
- VulnCheck
Tham khảo
- https://abraxaslabs.tech/research/cakephp-collate-sqli
- https://github.com/cakephp/cakephp
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/IdentifierExpression.php#L106
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/StringExpression.php#L77
- https://github.com/cakephp/cakephp/commit/21951faea40060dcc5cc1da3159056df66816d3c
- https://github.com/cakephp/cakephp/commit/ac07372e6a3045ce2030701a5bc5ed71aa2b4b82
- https://github.com/cakephp/cakephp/commit/ae8c354cf825aeb7090ea4b48ce98142446f3ac9
- https://github.com/cakephp/cakephp/commit/d04d342c3d1e0bac7ce7661bc098902cc412e595
- https://github.com/cakephp/cakephp/pull/19726
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-stringexpression-and-identifierexpression-collation