Weaknesses of type CWE-89

12,846 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-0410—WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-24846—Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-25054—WPcalc <= 2.1 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-24952—Conversios.io < 4.6.2 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2022-22735—Simple Quotation <= 1.3.2 - Subscriber+ SQL injectionEPSS 1.3%CVE-2021-24860—BSK PDF Manager < 3.1.2 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-24889—Ninja Forms < 3.6.4 - Admin+ SQL InjectionEPSS 1.3%CVE-2023-7337HIGHJS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' CookieEPSS 1.3%CVE-2021-24774—Check & Log Email < 1.0.3 - Admin+ SQL InjectionsEPSS 1.3%CVE-2021-24858—WP Cookie User Info < 1.0.9 - Admin+ SQL InjectionEPSS 1.3%CVE-2023-30246CRITICALSQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_iEPSS 1.3%CVE-2023-30245CRITICALSQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id paraEPSS 1.3%CVE-2018-8914HIGHSQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arEPSS 1.3%CVE-2022-0255—Database Backup for WordPress < 2.5.1 - Admin+ SQL InjectionEPSS 1.3%CVE-2022-0887—Easy Social Icons < 3.1.4 - Admin+ SQL InjectionEPSS 1.3%CVE-2024-32136HIGHWordPress BWL Advanced FAQ Manager plugin <= 2.0.3 - Auth. SQL Injection vulnerabilityEPSS 1.3%CVE-2024-45174HIGHAn issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, diffeEPSS 1.3%CVE-2017-12364—A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to executeEPSS 1.3%CVE-2021-25068—Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLiEPSS 1.3%CVE-2021-24777—Hotscot Contact Form < 1.3 - Admin+ SQL InjectionEPSS 1.3%