CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
What to do
- Upgrade to a fixed version: cakephp/database 4.6.5, cakephp/database 5.1.9, cakephp/database 5.2.14, cakephp/database 5.3.7 (see table).
- Redeploy and restart long-running processes so they load the fixed code.
Affected packages
cakephp/database
- >= 4.6.0, < 4.6.5
- 4.6.5
Check your project: composer show cakephp/database
cakephp/database
- >= 5.0.0, < 5.1.9
- 5.1.9
Check your project: composer show cakephp/database
cakephp/database
- >= 5.2.0, < 5.2.14
- 5.2.14
Check your project: composer show cakephp/database
cakephp/database
- >= 5.3.0, < 5.3.7
- 5.3.7
Check your project: composer show cakephp/database
cakephp/cakephp
- < 4.5.12
- 4.5.12
Check your project: composer show cakephp/cakephp
cakephp/cakephp
- >= 4.6.0, < 4.6.5
- 4.6.5
Check your project: composer show cakephp/cakephp
cakephp/cakephp
- >= 5.0.0, < 5.1.9
- 5.1.9
Check your project: composer show cakephp/cakephp
cakephp/cakephp
- >= 5.2.0, < 5.2.14
- 5.2.14
Check your project: composer show cakephp/cakephp
cakephp/cakephp
- >= 5.3.0, < 5.3.7
- 5.3.7
Check your project: composer show cakephp/cakephp
cakephp/database
- >= 3.0.0, < 4.5.12
- 4.5.12
Check your project: composer show cakephp/database