Listen to this Post
The vulnerability exists within the
`PaginatorHelper::limitControl()`
method. This helper generates a select dropdown control for pagination limit, typically used to let users choose how many items to display per page (e.g., 20, 50, 100). The method improperly outputs user-controlled query string parameters directly into the generated HTML without adequate escaping. An attacker can craft a malicious URL containing a script payload within a specific query parameter that this method processes. When a victim, such as an administrator, clicks the manipulated link while authenticated, the application renders the malicious parameter value unsanitized into the page’s HTML output. This results in the execution of arbitrary JavaScript in the context of the victim’s session. The attack is “reflected” because the payload is delivered via a single HTTP request and immediately reflected back in the response. This could allow attackers to steal session cookies, perform actions on behalf of the user, or deface the website.
The vulnerability is of moderate severity as it requires user interaction and specific application configuration where the vulnerable helper is in use.
Platform: CakePHP
Version: >=5.2.10,<5.2.12
Vulnerability: Reflected XSS
Severity: Moderate
date: 2026-01-16
Prediction: Patched 2026-01-16
What Undercode Say:
composer show cakephp/cakephp grep -r "limitControl" app/
// Vulnerable code pattern in view echo $this->Paginator->limitControl();
How Exploit:
Attacker sends crafted URL: https://target.com/page?limit=%3Cscript%3Ealert(document.cookie)%3C/script%3E`
<h2 style="color: blue;">Vulnerable method `limitControl()` unsafely echoes the `limit` parameter.</h2>
<h2 style="color: blue;">Victim clicks link, payload executes.</h2>
<h2 style="color: blue;">Protection from this CVE</h2>
<h2 style="color: blue;">Upgrade to 5.2.12.</h2>
<h2 style="color: blue;">Or 5.3.1.</h2>
<h2 style="color: blue;">Avoid usinglimitControl()`.
Impact:
Session hijacking.
Unauthorized actions.
Data theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
