Fallos del tipo CWE-89

12.846 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-1372CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows aEPSS 1.2%CVE-2022-26514CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_tagHandler.ashxEPSS 1.2%CVE-2020-7577—A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Through thEPSS 1.2%CVE-2022-1374CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This EPSS 1.2%CVE-2022-26059CRITICALDelta Electronics DIAEnergie SQL Injection in GetQueryDataEPSS 1.2%CVE-2022-1375CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. ThiEPSS 1.2%CVE-2022-26666CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashxEPSS 1.2%CVE-2022-26069CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerPage_KID.ashxEPSS 1.2%CVE-2022-26836CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashxEPSS 1.2%CVE-2022-1371CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. This allows an aEPSS 1.2%CVE-2022-27175CRITICALDelta Electronics DIAEnergie SQL Injection in GetCalcTagListEPSS 1.2%CVE-2022-1377CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. ThisEPSS 1.2%CVE-2022-25980CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerCommon.ashxEPSS 1.2%CVE-2022-1369CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. This allows anEPSS 1.2%CVE-2022-25880CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashxEPSS 1.2%CVE-2022-26667CRITICALDelta Electronics DIAEnergie SQL Injection in GetDemandAnalysisDataEPSS 1.2%CVE-2022-26065CRITICALDelta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisDataEPSS 1.2%CVE-2022-26349CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashxEPSS 1.2%CVE-2022-1370CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows aEPSS 1.2%CVE-2024-13478HIGHLTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL InjectionEPSS 1.2%