Fallos del tipo CWE-89

12.846 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-0410—WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-24846—Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-25054—WPcalc <= 2.1 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-24952—Conversios.io < 4.6.2 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2022-22735—Simple Quotation <= 1.3.2 - Subscriber+ SQL injectionEPSS 1.3%CVE-2021-24860—BSK PDF Manager < 3.1.2 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-24889—Ninja Forms < 3.6.4 - Admin+ SQL InjectionEPSS 1.3%CVE-2023-7337HIGHJS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' CookieEPSS 1.3%CVE-2021-24774—Check & Log Email < 1.0.3 - Admin+ SQL InjectionsEPSS 1.3%CVE-2021-24858—WP Cookie User Info < 1.0.9 - Admin+ SQL InjectionEPSS 1.3%CVE-2023-30246CRITICALSQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_iEPSS 1.3%CVE-2023-30245CRITICALSQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id paraEPSS 1.3%CVE-2018-8914HIGHSQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arEPSS 1.3%CVE-2022-0255—Database Backup for WordPress < 2.5.1 - Admin+ SQL InjectionEPSS 1.3%CVE-2022-0887—Easy Social Icons < 3.1.4 - Admin+ SQL InjectionEPSS 1.3%CVE-2024-32136HIGHWordPress BWL Advanced FAQ Manager plugin <= 2.0.3 - Auth. SQL Injection vulnerabilityEPSS 1.3%CVE-2024-45174HIGHAn issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, diffeEPSS 1.3%CVE-2017-12364—A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to executeEPSS 1.3%CVE-2021-25068—Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLiEPSS 1.3%CVE-2021-24777—Hotscot Contact Form < 1.3 - Admin+ SQL InjectionEPSS 1.3%