CakePHP through version 5.4.3 contains a SQL injection flaw that allows an attacker to embed arbitrary SQL statements by providing unvalidated frame offsets and directions to the WindowExpression::range() and frame() methods. When an application forwards user input into the OVER clause of a query, the vulnerability permits execution of any SQL command with the privileges of the database connection, enabling data theft, modification, or denial of service within the database.

The affected product is CakePHP, with all releases up to and including 5.4.3. Sites that rely on these versions and employ the WindowExpression::range() or frame() APIs in code paths that accept user control are vulnerable.

The CVSS score of 9.2 indicates a high severity, signifying a complete ability to impact confidentiality, integrity, and availability of the database. The EPSS score is not available, but the flaw is exploitable via standard web user input that reaches the affected methods, making a near‑future attack realistic. The vulnerability is not listed in CISA KEV, yet the lack of mitigation and the obvious attack surface raise the risk of exploitation by a motivated threat actor.