CakePHP SQL注入漏洞

CakePHP is the U.S. CAKE Foundation of a MVC-based architecture , open source Web development framework. The framework has flexible view caching, automatic generation of CRUD code and other features. CakePHP suffers from an SQL injection vulnerability that stems from the CakeDatabaseQuery::limit...

CakePHP 4.2.11, 4.3.11, and 4.4.10 Released

CakePHP 4.2.11, 4.3.11, and 4.4.10 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 4.2.11, 4.3.11, and 4.4.10. These releases contain a security fix for the limit and offset methods of Cake\Database\Query. If passed unfiltered request data, these methods...

Vulnerability in CakePHP fixed

In CakePHP version 3.10.4, an encryption issue of CsrfProtectionMiddleware has been fixed. In 3.10.3, verified tokens were generated using random bytes and would often not match when they were rendered in HTML. No CVE number was issued for this vulnerability. CakePHP's developers have issued...

GHSA-9PGX-PF36-W46R CakePHP allows method override parameters to bypass CSRF checks

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...

CakePHP allows method override parameters to bypass CSRF checks

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...

CakePHP 3.10.4 Released

CakePHP 3.10.4 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.10.4. This is a maintenance and security release for the 3.10 branch that fixes a community reported issue, and patches a security vulnerability. Security Fixes The 3.10.4 release fixes an...

GHSA-G2VX-8V47-4VHH CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code

The validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted dataTokenfields value that is processed by the unserialize function, as demonstrated by...

CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code

The validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted dataTokenfields value that is processed by the unserialize function, as demonstrated by...

GHSA-R7P6-FR3X-R877 CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files...

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files...

GHSA-5964-PQ8R-4Q62 CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection attack...

CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection attack...

GHSA-556Q-H4VR-PGH2 CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter...

CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter...

GHSA-J8P3-8M69-2HQQ CakePHP allows remote attackers to spoof their IP

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...

CakePHP allows remote attackers to spoof their IP

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...

CakePHP 3.10.3 Released

CakePHP 3.10.3 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.10.3. This is a maintenance and security release for the 3.10 branch that fixes a couple community reported issues, and patches a security vulnerability. Security Fixes The 3.10.3 release...

GHSA-RW73-XMPV-J5X2 CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, followed by a filename ending with %00 and a .js filename...

CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, followed by a filename ending with %00 and a .js filename...

GHSA-VC29-MVWV-WPCQ Cross-site scripting (XSS) vulnerability in CakePHP

Cross-site scripting XSS vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 "Not Found" error page. NOTE: some of these details are obtained from third party information...