CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code

published 2011-01-14 15 y ago modified 2026-06-16 4 mo ago also GHSA-g2vx-8v47-4vhh , EUVD-2022-3864

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 55.2%; EPSS 55.2% chance of exploitation in 30 days, percentile 99%
public exploits: 3; Metasploit, Exploit-DB

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

Patch / fix

fixed in 1 distros 1 links 1

packagist cakephp/cakephp 1.3.6

cakephp Debian 11 1.3.2-1.1

debian advisories DEBIAN-CVE-2010-4335

github.com/cakephp/cakephp@e431e86 commit

Timeline

2010-11-15 First public exploit (Metasploit exploit/unix/webapp/cakephp_cache_corruption)
2011-01-14 Published

Exploit prediction

55.20% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/unix/webapp/cakephp_cache_corruption CakePHP Cache Corruption Code Execution metasploit exploit, excellent rank, 2010-11-15
EDB-16902 CakePHP 1.3.5/1.2.8 - Cache Corruption (Metasploit) webapps, 2011-01-14
EDB-16011 CakePHP 1.3.5/1.2.8 - 'Unserialize()' File Inclusion webapps, 2011-01-18
packetstormsecurity.org http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt referenced PoC, tagged "exploit" by a source, unverified
malloc.im http://malloc.im/CakePHP-unserialize.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
packagist	cakephp/cakephp	>=1.2.8, <1.3.6	1.3.6

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /cakephp/cakephp/commit/e431e86aa4301ced4273dc7919b59362cbb353cb
web, patch
exploit-db.com /exploits/16011
exploit, web
packetstormsecurity.org /files/view/95847/burnedcake.py.txt
web, exploit
malloc.im /CakePHP-unserialize.txt
web, exploit
secunia.com /advisories/42211
third-party-advisory, web, vendor-advisory
osvdb.org /69352
vdb-entry, web
securityreason.com /securityalert/8026
third-party-advisory, web
nvd.nist.gov /vuln/detail/CVE-2010-4335
advisory
github.com /cakephp/cakephp
package

Sources

CVE List CVE-2010-4335
GitHub Advisory GHSA-g2vx-8v47-4vhh
NVD CVE-2010-4335

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary