Fallos del tipo CWE-89

12.910 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-6402MEDIUMPHPGurukul Nipah Virus Testing Management System add-phlebotomist.php sql injectionEPSS 0.8%CVE-2023-36361CRITICALAudimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.EPSS 0.8%CVE-2022-41535HIGHOpen Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/managEPSS 0.8%CVE-2022-41536HIGHOpen Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/managEPSS 0.8%CVE-2022-41498HIGHBilling System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editbrand.php.EPSS 0.8%CVE-2022-42218HIGHOpen Source SACCO Management System v1.0 vulnerable to SQL Injection via /sacco_shield/manage_loan.php.EPSS 0.8%CVE-2016-15018MEDIUMkrail-jpa sql injectionEPSS 0.8%CVE-2023-7106MEDIUMcode-projects E-Commerce Website sql injectionEPSS 0.8%CVE-2023-48078CRITICALSQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' paraEPSS 0.8%CVE-2023-1984MEDIUMSourceCodester Complaint Management System POST Parameter check_availability.php sql injectionEPSS 0.8%CVE-2023-27041CRITICALSchool Registration and Fee System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at/bilal final/edit_useEPSS 0.8%CVE-2022-2802HIGHSourceCodester Gas Agency Management System login.php sql injectionEPSS 0.8%CVE-2023-48738CRITICALWordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to SQL InjectionEPSS 0.8%CVE-2024-1893HIGHEasy Property Listings <= 3.5.2 - Authenticated(Contributor+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5663HIGHNews Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5465HIGHPopup with fancybox <= 3.5 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2024-3226HIGHCampcodes Online Patient Record Management System login.php sql injectionEPSS 0.8%CVE-2022-0842MEDIUMePO blind SQL Injection vulnerabilityEPSS 0.8%CVE-2024-0685MEDIUMNinja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL InjectionEPSS 0.8%CVE-2026-13161HIGHTrueBooker <= 1.2.2 - Unauthenticated SQL InjectionEPSS 0.8%