Fallos del tipo CWE-89

12.938 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-3799MEDIUMIBOS OA Delete Category del sql injectionEPSS 0.7%CVE-2024-42556CRITICALHotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_remEPSS 0.7%CVE-2024-6371MEDIUMitsourcecode Pool of Bethesda Online Reservation System controller.php sql injectionEPSS 0.7%CVE-2022-2703MEDIUMSourceCodester Gym Management System Exercises Module sql injectionEPSS 0.7%CVE-2022-2727MEDIUMSourceCodester Gym Management System login.php sql injectionEPSS 0.7%CVE-2022-2687MEDIUMSourceCodester Gym Management System sql injectionEPSS 0.7%CVE-2023-33478CRITICALRemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php.EPSS 0.7%CVE-2023-1770MEDIUMSourceCodester Grade Point Average GPA Calculator Master.php get_scale sql injectionEPSS 0.7%CVE-2022-2728MEDIUMSourceCodester Gym Management System index.php sql injectionEPSS 0.7%CVE-2025-27659CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002.EPSS 0.7%CVE-2025-27640CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows SQL Injection V-2024-012.EPSS 0.7%CVE-2022-2693MEDIUMSourceCodester Electronic Medical Records System UPDATE Statement register.php sql injectionEPSS 0.7%CVE-2023-1480MEDIUMSourceCodester Monitoring of Students Cyber Accounts System POST Parameter login.php sql injectionEPSS 0.7%CVE-2022-2698MEDIUMSourceCodester Simple E-Learning System search.php sql injectionEPSS 0.7%CVE-2022-2707MEDIUMSourceCodester Online Class and Exam Scheduling System faculty_sched.php sql injectionEPSS 0.7%CVE-2022-2706MEDIUMSourceCodester Online Class and Exam Scheduling System class_sched.php sql injectionEPSS 0.7%CVE-2023-33479CRITICALRemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file.EPSS 0.7%CVE-2022-2705MEDIUMSourceCodester Simple Student Information System manage_department.php sql injectionEPSS 0.7%CVE-2023-33481CRITICALRemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php.EPSS 0.7%CVE-2022-3012MEDIUMoretnom23 Fast Food Ordering System index.php sql injectionEPSS 0.7%