Fallos del tipo CWE-89

12.895 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-45535MEDIUMAeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \admin\categories.php. This vulnerability aEPSS 0.8%CVE-2023-4176MEDIUMSourceCodester Hospital Management System appointmentapproval.php sql injectionEPSS 0.8%CVE-2023-1475MEDIUMSourceCodester Canteen Management System createuser.php query sql injectionEPSS 0.8%CVE-2022-25607MEDIUMWordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerabilityEPSS 0.8%CVE-2022-2262MEDIUMOnline Hotel Booking System Room edit_all_room.php sql injectionEPSS 0.8%CVE-2023-4179MEDIUMSourceCodester Free Hospital Management System for Small Practices sql injectionEPSS 0.8%CVE-2023-3988MEDIUMCafe Billing System Order index.php sql injectionEPSS 0.8%CVE-2024-50389CRITICALQuRouterEPSS 0.8%CVE-2023-2596MEDIUMSourceCodester Online Reviewer System GET Parameter user-update.php sql injectionEPSS 0.8%CVE-2022-42245CRITICALDreamer CMS 4.0.01 is vulnerable to SQL Injection.EPSS 0.8%CVE-2022-43213CRITICALBilling System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editorder.php.EPSS 0.8%CVE-2024-2074MEDIUMMini-Tmall 1 sql injectionEPSS 0.8%CVE-2024-29872CRITICALSQL injection vulnerability in SentrifugoEPSS 0.8%CVE-2023-40629—Extension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.1EPSS 0.8%CVE-2024-29873CRITICALSQL injection vulnerability in SentrifugoEPSS 0.8%CVE-2023-49708—Extension - joomstar.com - SQLi vulnerability in Starshop component for Joomla 1.0.0-1.0.9EPSS 0.8%CVE-2023-49707—Extension - joomlart.com - SQLi vulnerability in S5 Register module for Joomla 1.0.0-3.0.0EPSS 0.8%CVE-2023-2690MEDIUMSourceCodester Personnel Property Equipment System GET Parameter returned_reuse_form.php sql injectionEPSS 0.8%CVE-2025-62388MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 0.8%CVE-2023-2689MEDIUMSourceCodester Billing Management System GET Parameter editproduct.php sql injectionEPSS 0.8%