Weaknesses of type CWE-89

12,846 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-1372CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows aEPSS 1.2%CVE-2022-26514CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_tagHandler.ashxEPSS 1.2%CVE-2020-7577—A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Through thEPSS 1.2%CVE-2022-1374CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This EPSS 1.2%CVE-2022-26059CRITICALDelta Electronics DIAEnergie SQL Injection in GetQueryDataEPSS 1.2%CVE-2022-1375CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. ThiEPSS 1.2%CVE-2022-26666CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashxEPSS 1.2%CVE-2022-26069CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerPage_KID.ashxEPSS 1.2%CVE-2022-26836CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashxEPSS 1.2%CVE-2022-1371CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. This allows an aEPSS 1.2%CVE-2022-27175CRITICALDelta Electronics DIAEnergie SQL Injection in GetCalcTagListEPSS 1.2%CVE-2022-1377CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. ThisEPSS 1.2%CVE-2022-25980CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerCommon.ashxEPSS 1.2%CVE-2022-1369CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. This allows anEPSS 1.2%CVE-2022-25880CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashxEPSS 1.2%CVE-2022-26667CRITICALDelta Electronics DIAEnergie SQL Injection in GetDemandAnalysisDataEPSS 1.2%CVE-2022-26065CRITICALDelta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisDataEPSS 1.2%CVE-2022-26349CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashxEPSS 1.2%CVE-2022-1370CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows aEPSS 1.2%CVE-2024-13478HIGHLTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL InjectionEPSS 1.2%