SQL Injection

🗓️ 30 Jan 2023 09:11:00Reported by Veracode Vulnerability DatabaseType

CakePHP SQL Injection vulnerability in limit() and offset() function

Reporter	Title	Published	Views	Family All 18
Circl	CVE-2023-22727	18 Jan 202300:15	–	circl
CNNVD	CakePHP SQL注入漏洞	17 Jan 202300:00	–	cnnvd
CVE	CVE-2023-22727	17 Jan 202320:41	–	cve
Cvelist	CVE-2023-22727 Database Query::offset() and limit() vulnerable to SQL injection in cakephp	17 Jan 202320:41	–	cvelist
Debian CVE	CVE-2023-22727	17 Jan 202320:41	–	debiancve
EUVD	EUVD-2023-0361	3 Oct 202520:07	–	euvd
Github Security Blog	CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection	20 Jan 202317:30	–	github
NVD	CVE-2023-22727	17 Jan 202321:15	–	nvd
OSV	CVE-2023-22727 Database Query::offset() and limit() vulnerable to SQL injection in cakephp	17 Jan 202320:41	–	osv
OSV	DEBIAN-CVE-2023-22727	17 Jan 202321:15	–	osv

Vulners

Node

cakephp cakephp/cakephpRange3.0.0-alpha1–4.2.11php

cakephp cakephp/cakephpRange4.3.0-RC1–4.3.10php

cakephp cakephp/cakephpRange4.4.0-RC1–4.4.9php

oracle cakephp/databaseRange3.0.0-RC1–4.2.11php

oracle cakephp/databaseRange4.3.0-RC1–4.3.10php

oracle cakephp/databaseRange4.4.0-RC1–4.4.9php

Source	Link
bakery	www.bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html
github	www.github.com/cakephp/cakephp/pull/16925
github	www.github.com/cakephp/cakephp/commit/5db1eb7aa8e4bad4f67e4a3b5a71bb4dba2afd8a
github	www.github.com/cakephp/database/commit/a9dceaf146165b51c4c11d768fa97f4f073b4653
github	www.github.com/cakephp/cakephp/commit/d3e18fa1fdf53854ea94c20835d6ffac999eb0f2
github	www.github.com/cakephp/database/commit/886590811cc0554b1cf8e8802cdafcc02db48a7e
github	www.github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239
github	www.github.com/cakephp/database/commit/c12a8f30f802968a885774e2ac3c099f470bf07c
github	www.github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wp

31 Jan 2023 15:30Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.0093

SSVC