Fallos del tipo CWE-89

12.846 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-7808MEDIUMcode-projects Job Portal logindbc.php sql injectionEPSS 1.2%CVE-2022-0507MEDIUMVulnerability: Authenticated SQL Injection in APIEPSS 1.2%CVE-2024-46903MEDIUMA vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive informatiEPSS 1.2%CVE-2024-28557CRITICALSQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate pEPSS 1.2%CVE-2020-15108HIGHSQL Injection in glpiEPSS 1.2%CVE-2023-27649HIGHSQL injection vulnerability found in Trusted Tools Free Music v.2.1.0.47, v.2.0.0.46, v.1.9.1.45, v.1.8.2.43 allows a remote attacker to cauEPSS 1.2%CVE-2024-28556CRITICALSQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate pEPSS 1.2%CVE-2021-24138—AdRotate < 5.8.4 - Authenticated SQL InjectionEPSS 1.2%CVE-2022-0757MEDIUMRapid7 Nexpose SQL InjectionEPSS 1.2%CVE-2022-40944CRITICALDairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.EPSS 1.2%CVE-2021-34249HIGHSQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremetEPSS 1.2%CVE-2024-28595CRITICALSQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in EPSS 1.2%CVE-2019-1942MEDIUMCisco Identity Services Engine Blind SQL Injection VulnerabilityEPSS 1.2%CVE-2024-55972CRITICALWordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerabilityEPSS 1.2%CVE-2021-31867MEDIUMPimcore Customer Data Framework 'SegmentAssignmentController.php' Blind SQL InjectionEPSS 1.2%CVE-2021-24864—WP Cloudy < 4.4.9 - Admin+ SQL InjectionEPSS 1.2%CVE-2022-2766HIGHSourceCodester Loan Management System index.php sql injectionEPSS 1.2%CVE-2020-36541HIGHDemokratian genera_select.php sql injectionEPSS 1.2%CVE-2022-1376CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx. EPSS 1.2%CVE-2022-1372CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows aEPSS 1.2%