Weaknesses of type CWE-89

12,878 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-2046CRITICALSQLi in Yontem Vehicle TrackingSsystemEPSS 0.9%CVE-2023-29863CRITICALMedical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameterEPSS 0.9%CVE-2023-2852CRITICALSQLi in SoftMed's SelfPatronEPSS 0.9%CVE-2022-42143HIGHOpen Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php.EPSS 0.9%CVE-2024-57430CRITICALAn SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate databEPSS 0.9%CVE-2023-29985CRITICALSourcecodester Student Study Center Desk Management System v1.0 admin\reports\index.php#date_from has a SQL Injection vulnerability.EPSS 0.9%CVE-2023-24774CRITICALFunadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.EPSS 0.9%CVE-2023-27358HIGHNETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2020-27236MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attEPSS 0.9%CVE-2020-27234MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker EPSS 0.9%CVE-2020-27235MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attackerEPSS 0.9%CVE-2022-44785CRITICALAn issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, soEPSS 0.9%CVE-2024-2018HIGHWP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL InjectionEPSS 0.9%CVE-2020-27233MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attackerEPSS 0.9%CVE-2021-43926MEDIUMImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in SynoloEPSS 0.9%CVE-2021-43927MEDIUMImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in SEPSS 0.9%CVE-2023-6657MEDIUMSourceCodester Simple Student Attendance System student_form.php sql injectionEPSS 0.9%CVE-2021-43925MEDIUMImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in SynoloEPSS 0.9%CVE-2024-29875CRITICALSQL injection vulnerability in SentrifugoEPSS 0.9%CVE-2022-2468MEDIUMSourceCodester Garage Management System editbrand.php sql injectionEPSS 0.9%