CyberRota Analysis
AI-GeneratedCustom mail headers in CakePHP prior to specified versions are vulnerable to header injection due to the failure to sanitize CRLF bytes when using Message::setHeaders() or Message::addHeaders() with user-controlled data. This vulnerability can lead to unauthorized manipulation of email headers, potentially allowing attackers to spoof emails or execute further attacks. Developers and organizations using affected versions of CakePHP should prioritize upgrading to the patched versions to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.