Weaknesses of type CWE-89

13,619 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2021-24580—Side Menu Lite < 2.2.6 - Authenticated SQL InjectionEPSS 1.4%CVE-2021-24462—Photo Gallery by Ays - Responsive Image Gallery < 4.4.4 - Authenticated Blind SQL InjectionsEPSS 1.4%CVE-2021-24575—WPSchoolPress < 2.1.10 - Multiple Authenticated SQL InjectionsEPSS 1.4%CVE-2021-24846—Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2021-24847—SEO Redirection < 8.2 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2021-24848—Mediamatic < 2.8.1 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2021-25054—WPcalc <= 2.1 - Authenticated SQL InjectionEPSS 1.4%CVE-2021-24748—Email Before Download < 6.8 - Admin+ SQL InjectionEPSS 1.4%CVE-2021-24829—Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2021-24755—myCred < 2.3 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2024-23119HIGHCentreon insertGraphTemplate SQL Injection Remote Code Execution VulnerabilityEPSS 1.4%CVE-2022-1123—Leaflet Maps Marker < 3.12.5 - Admin+ SQLiEPSS 1.4%CVE-2022-2593—Better Search and Replace < 1.4.1 - Admin+ SQLiEPSS 1.4%CVE-2023-51951CRITICALSQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id parameter in the maEPSS 1.4%CVE-2020-36073HIGHSQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameteEPSS 1.3%CVE-2007-2534CRITICALMultiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN_USEPSS 1.3%CVE-2020-25700—In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 toEPSS 1.3%CVE-2021-24957—Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injectionEPSS 1.3%CVE-2022-1182—Visual Slide Box Builder <= 3.2.9 - Subscriber+ SQLiEPSS 1.3%CVE-2021-21380HIGHRating Script Service expose XWiki to SQL injectionEPSS 1.3%