Login Request a demo
Critical severity · published Jan 17, 2023
CVE-2023-22727
Database Query::offset() and limit() vulnerable to SQL injection in cakephp
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cakephp · cakephp
>= 4.2.0, < 4.2.12; >= 4.3.0, < 4.3.11; >= 4.4.0, < 4.4.10 · source: vendor, NVD
Affected product
CA
cakephp
cakephp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22727
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22727
Release Notes
https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html
Patch
https://github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239
Third Party Advisory
https://github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wp
More from cakephp
9.2
CVE-2026-79752
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
9.2
CVE-2026-77635
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
8.8
CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3
8.8
CVE-2015-8379
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter
8.2
CVE-2026-77634
CakePHP: SmtpTransport vulnerable to CRLF header injection