| Package | Affected versions | Patched versions |
|---|---|---|
| cakephp/cakephp | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7 | 5.1.105.2.155.3.7 |
| cakephp/database | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7 | 5.1.105.2.155.3.7 |
The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
5.1.10, 5.2.15, 5.3.7
Don't provide user controlled data to these functions/parameters.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free