Fallos del tipo CWE-89

12.895 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-20786MEDIUMCisco Unified Communications Manager IM & Presence Service SQL Injection VulnerabilityEPSS 0.8%CVE-2022-3118HIGHSourcecodehero ERP System Project processlogin.php sql injectionEPSS 0.8%CVE-2023-2607HIGHMultiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL InjectionEPSS 0.8%CVE-2021-36392—In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.EPSS 0.8%CVE-2022-2842HIGHSourceCodester Gym Management System login.php sql injectionEPSS 0.8%CVE-2022-45010CRITICALSimple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/editEPSS 0.8%CVE-2023-1474MEDIUMSourceCodester Automatic Question Paper Generator System GET Parameter manage_question_paper.php sql injectionEPSS 0.8%CVE-2023-3340MEDIUMSourceCodester Online School Fees System GET Parameter ajx.php sql injectionEPSS 0.8%CVE-2022-30025MEDIUMSQL injection in "/Framewrk/Home.jsp" file (POST method) in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote atEPSS 0.8%CVE-2015-10063HIGHsaemorris TheRadSystem _login.php redirect sql injectionEPSS 0.8%CVE-2020-23966CRITICALSQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafteEPSS 0.8%CVE-2026-33324CRITICALSQLBot prompt injection allows arbitrary SQL execution and remote code executionEPSS 0.8%CVE-2023-3152MEDIUMSourceCodester Online Discussion Forum Site view_post.php sql injectionEPSS 0.8%CVE-2024-4794MEDIUMCampcodes Online Laundry Management System manage_receiving.php sql injectionEPSS 0.8%CVE-2023-3149MEDIUMSourceCodester Online Discussion Forum Site manage_user.php sql injectionEPSS 0.8%CVE-2024-2644MEDIUMNetentsec NS-ASG Application Security Gateway addfirewall.php sql injectionEPSS 0.8%CVE-2024-4805MEDIUMKashipara College Management System edit_faculty.php sql injectionEPSS 0.8%CVE-2024-4793MEDIUMCampcodes Online Laundry Management System manage_laundry.php sql injectionEPSS 0.8%CVE-2024-4792MEDIUMCampcodes Online Laundry Management System admin_class.php sql injectionEPSS 0.8%CVE-2024-2649MEDIUMNetentsec NS-ASG Application Security Gateway deleteonlineuser.php sql injectionEPSS 0.8%