Fallos del tipo CWE-89

12.894 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-41542CRITICALSQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information viaEPSS 0.9%CVE-2023-28438MEDIUMPimcore vulnerable to improper quoting of filters in Custom ReportsEPSS 0.9%CVE-2024-29870CRITICALSQL injection vulnerability in SentrifugoEPSS 0.9%CVE-2022-2812HIGHSourceCodester Guest Management System index.php sql injectionEPSS 0.9%CVE-2023-28108HIGHPimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID ModelEPSS 0.9%CVE-2022-1839MEDIUMHome Clean Services Management System login.php sql injectionEPSS 0.9%CVE-2022-44151CRITICALSimple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php.EPSS 0.9%CVE-2021-36503CRITICALSQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php fEPSS 0.9%CVE-2021-41187HIGHSQL Injection in DHIS2 Tracker APIEPSS 0.9%CVE-2023-23459CRITICALPriority Windows – Command Execution via SQL Injection EPSS 0.9%CVE-2023-40046HIGHWS_FTP Server SQL Injection via Administrative InterfaceEPSS 0.9%CVE-2022-4151MEDIUMContest Gallery < 19.1.5 - Admin+ SQL InjectionEPSS 0.9%CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2021-36432HIGHSQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_maskEPSS 0.9%CVE-2020-36859HIGHNagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit PagesEPSS 0.9%CVE-2026-45779CRITICALOpen XDMoD Vulnerable to Unauthenticated SQL Injection Leading to Full Database CompromiseEPSS 0.9%CVE-2023-30867—Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerabilityEPSS 0.9%CVE-2024-3349HIGHSourceCodester Aplaya Beach Resort Online Reservation System login.php sql injectionEPSS 0.9%CVE-2024-11649MEDIUM1000 Projects Beauty Parlour Management System search-appointment.php sql injectionEPSS 0.9%CVE-2024-3439HIGHSourceCodester Prison Management System login.php sql injectionEPSS 0.9%