A critical SQL injection vulnerability in the CakePHP framework allows unauthenticated attackers to execute arbitrary SQL commands against backend PostgreSQL databases.

The vulnerability exists in the FunctionsBuilder::jsonValue() function when handling user-controlled data via the PostgresDriver. This flaw enables SQL injection, which can be triggered by an unauthenticated attacker supplying malicious input to the jsonPath parameter.

Successful exploitation of this flaw could result in complete unauthorized access to database contents, including sensitive application data and credentials. Given the CVSS score of 9.2, this vulnerability poses a severe risk to data confidentiality and integrity, potentially leading to regulatory non-compliance and significant reputational damage.

Immediate Action: Upgrade to CakePHP versions 5.1.10, 5.2.15, or 5.3.7 or higher immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review database query logs for unusual patterns or syntax errors that may indicate automated injection attempts targeting the JSON path functionality.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting JSON-related parameters.

Public Exploit Available: Unknown

This vulnerability represents a high-severity risk due to the potential for full database compromise. Administrators must prioritize updating all instances of the CakePHP framework to the specified patched versions to eliminate the underlying injection vector.