Threats tagged 'ghsa-vjqc-q4mp-2rvf'

Multiple methods in CakePHP's FunctionsBuilder component are vulnerable to SQL injection when user-controlled data is passed to specific parameters. The affected methods are cast(), extract(), datePart(), and dateAdd(). This vulnerability allows attackers to inject malicious SQL code via the $dataType, $part, or $unit parameters. Fixed versions have been released across multiple CakePHP versions. Users are advised not to supply user-controlled data to these parameters as a workaround.