VYPR
← All advisories
Critical severityNVD Advisory· Published Jan 17, 2023· Updated Mar 10, 2025

Database Query::offset() and limit() vulnerable to SQL injection in cakephp

CVE-2023-22727

Description

CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cakephp/cakephpPackagist
>= 4.2.0, < 4.2.124.2.12
cakephp/cakephpPackagist
>= 4.3.0, < 4.3.114.3.11
cakephp/cakephpPackagist
>= 4.4.0, < 4.4.104.4.10
cakephp/databasePackagist
>= 4.2.0, < 4.2.124.2.12
cakephp/databasePackagist
>= 4.3.0, < 4.3.114.3.11
cakephp/databasePackagist
>= 4.4.0, < 4.4.104.4.10

Affected products

1

Patches

1
3f463e7084b5

Disallow strings in limit() and offset()

https://github.com/cakephp/cakephpMark StoryJan 3, 2023via ghsa
commit
2 files changed · +32 −0
  • src/Database/Query.php+6 −0 modified
    @@ -1534,6 +1534,9 @@ public function page(int $num, ?int $limit = null)
      */
     public function limit($limit)
     {
+        if (is_string($limit) && !is_numeric($limit)) {
+            throw new InvalidArgumentException('Invalid value for `limit()`');
+        }
         $this->_dirty();
         $this->_parts['limit'] = $limit;
 
@@ -1560,6 +1563,9 @@ public function limit($limit)
      */
     public function offset($offset)
     {
+        if (is_string($offset) && !is_numeric($offset)) {
+            throw new InvalidArgumentException('Invalid value for `offset()`');
+        }
         $this->_dirty();
         $this->_parts['offset'] = $offset;
  • tests/TestCase/Database/QueryTest.php+26 −0 modified
    @@ -2218,6 +2218,32 @@ public function testSelectLimit(): void
         $this->assertCount(2, $result);
     }
 
+    /**
+     * Tests selecting rows with string offset/limit
+     */
+    public function testSelectLimitInvalid(): void
+    {
+        $query = new Query($this->connection);
+        $this->expectException(InvalidArgumentException::class);
+        $query->select('id')->from('comments')
+            ->limit('1 --more')
+            ->order(['id' => 'ASC'])
+            ->execute();
+    }
+
+    /**
+     * Tests selecting rows with string offset/limit
+     */
+    public function testSelectOffsetInvalid(): void
+    {
+        $query = new Query($this->connection);
+        $this->expectException(InvalidArgumentException::class);
+        $query->select('id')->from('comments')
+            ->offset('1 --more')
+            ->order(['id' => 'ASC'])
+            ->execute();
+    }
+
     /**
      * Tests selecting rows combining a limit and offset clause
      */

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.