Fallos del tipo CWE-89

12.874 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-29411HIGHWordPress Hermit 音乐播放器 plugin <= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerabilityEPSS 1.1%CVE-2023-37258HIGHDataEase has a SQL injection vulnerability that can bypass blacklistsEPSS 1.1%CVE-2022-48011CRITICALOpencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.EPSS 1.1%CVE-2024-22059HIGHA SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete informatiEPSS 1.1%CVE-2021-1470MEDIUMCisco SD-WAN SQL Injection VulnerabilityEPSS 1.1%CVE-2024-24213CRITICALSupabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendorEPSS 1.1%CVE-2021-40129MEDIUMCisco Common Services Platform Collector SQL Injection VulnerabilityEPSS 1.1%CVE-2024-3534HIGHCampcodes Church Management System login.php sql injectionEPSS 1.1%CVE-2024-3535HIGHCampcodes Church Management System index.php sql injectionEPSS 1.1%CVE-2022-47105CRITICALJeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.EPSS 1.1%CVE-2020-10505CRITICALALLE INFORMATION CO., LTD. School Manage System - SQL InjectionEPSS 1.1%CVE-2019-5116HIGHAn exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQEPSS 1.1%CVE-2019-5117HIGHExploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQEPSS 1.1%CVE-2019-5121HIGHSQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. AEPSS 1.1%CVE-2019-5110HIGHExploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQEPSS 1.1%CVE-2019-5109HIGHExploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SEPSS 1.1%CVE-2019-5120HIGHAn exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL EPSS 1.1%CVE-2023-48384CRITICALArmorX Global Technology Corporation ArmorX Spam - SQL InjectoinEPSS 1.1%CVE-2023-48372CRITICALITPison OMICARD EDM 's SMS - SQL InjectionEPSS 1.1%CVE-2024-44761CRITICALAn issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests.EPSS 1.1%