CyberRota Analysis
AI-GeneratedThe FunctionsBuilder::jsonValue() function in CakePHP is susceptible to SQL injection when user-controlled data is passed to the jsonPath parameter, affecting versions prior to 5.1.10, 5.2.15, and 5.3.7. This vulnerability could allow attackers to execute arbitrary SQL queries, potentially compromising the integrity and confidentiality of the database. Organizations using affected versions of CakePHP should prioritize updating to the patched versions to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.