Fallos del tipo CWE-89

12.846 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2021-24199—wpDataTables < 3.4.2 - Blind SQL Injection via start ParameterEPSS 1.3%CVE-2023-22275HIGHZDI-CAN-21306: Adobe RoboHelp Server GetNewUserId SQL Injection Information Disclosure VulnerabilityEPSS 1.3%CVE-2021-24345—Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL InjectionEPSS 1.3%CVE-2024-46257MEDIUMA Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote EPSS 1.3%CVE-2021-24835—WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-24606—Availability Calendar < 1.2.1 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-24669—MAZ Loader < 1.3.3 - Contributor+ SQL InjectionEPSS 1.3%CVE-2021-24758—Email Log < 2.4.7 - Admin+ SQL InjectionEPSS 1.3%CVE-2012-6427—Carlo Gavazzi EOS Box SQL InjectionEPSS 1.3%CVE-2022-2593—Better Search and Replace < 1.4.1 - Admin+ SQLiEPSS 1.3%CVE-2021-28999HIGHSQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameEPSS 1.3%CVE-2023-51586CRITICALVoltronic Power ViewPower Pro selectEventConfig SQL Injection Remote Code Execution VulnerabilityEPSS 1.3%CVE-2018-1096—An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perEPSS 1.3%CVE-2024-24495CRITICALSQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafteEPSS 1.3%CVE-2022-1123—Leaflet Maps Marker < 3.12.5 - Admin+ SQLiEPSS 1.3%CVE-2021-25064—Wow Countdowns <= 3.1.2 - Admin+ SQLiEPSS 1.3%CVE-2023-22324MEDIUMSQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbEPSS 1.3%CVE-2022-1182—Visual Slide Box Builder <= 3.2.9 - Subscriber+ SQLiEPSS 1.3%CVE-2021-24848—Mediamatic < 2.8.1 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-24952—Conversios.io < 4.6.2 - Subscriber+ SQL InjectionEPSS 1.3%