Description
CakePHP is a rapid development framework for PHP that provides an extensible
architecture for developing, maintaining, and deploying applications. Using
commonly known design patterns like MVC and ORM within the convention over
configuration paradigm, CakePHP reduces development costs and helps developers
write less code.
CakePHP is vulnerable to a file inclusion attack because of its use of the "unserialize()" function on unchecked user input. This makes it possible to inject arbitary objects into the scope.
Remediation
Upgrade CakePHP to the latest version.
References
Related Vulnerabilities
MySQL CVE-2016-3495 Vulnerability (CVE-2016-3495)
Envoy Proxy Uncontrolled Resource Consumption Vulnerability (CVE-2020-12605)
CKEditor Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-31541)
MySQL CVE-2012-0118 Vulnerability (CVE-2012-0118)
Atlassian Confluence Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-22504)