Critical severity9.8NVD Advisory· Published Jan 17, 2023· Updated Jun 17, 2026
CVE-2023-22727
CVE-2023-22727
Description
CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
cakephp/cakephpPackagist | >= 4.2.0, < 4.2.12 | 4.2.12 |
cakephp/cakephpPackagist | >= 4.3.0, < 4.3.11 | 4.3.11 |
cakephp/cakephpPackagist | >= 4.4.0, < 4.4.10 | 4.4.10 |
cakephp/databasePackagist | >= 4.2.0, < 4.2.12 | 4.2.12 |
cakephp/databasePackagist | >= 4.3.0, < 4.3.11 | 4.3.11 |
cakephp/databasePackagist | >= 4.4.0, < 4.4.10 | 4.4.10 |
Affected products
4- ghsa-coords2 versions
>= 4.2.0, < 4.2.12+ 1 more
- (no CPE)range: >= 4.2.0, < 4.2.12
- (no CPE)range: >= 4.2.0, < 4.2.12
Patches
Vulnerability mechanics
References
5- github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239nvdPatchThird Party AdvisoryWEB
- bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.htmlnvdRelease NotesVendor AdvisoryWEB
- github.com/advisories/GHSA-6g8q-qfpv-57wpghsaADVISORY
- github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wpnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-22727ghsaADVISORY
News mentions
0No linked articles in our index yet.