Fallos del tipo CWE-89

12.878 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-2046CRITICALSQLi in Yontem Vehicle TrackingSsystemEPSS 0.9%CVE-2023-29863CRITICALMedical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameterEPSS 0.9%CVE-2023-2852CRITICALSQLi in SoftMed's SelfPatronEPSS 0.9%CVE-2022-42143HIGHOpen Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php.EPSS 0.9%CVE-2024-57430CRITICALAn SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate databEPSS 0.9%CVE-2023-29985CRITICALSourcecodester Student Study Center Desk Management System v1.0 admin\reports\index.php#date_from has a SQL Injection vulnerability.EPSS 0.9%CVE-2023-24774CRITICALFunadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.EPSS 0.9%CVE-2023-27358HIGHNETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2020-27236MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attEPSS 0.9%CVE-2020-27234MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker EPSS 0.9%CVE-2020-27235MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attackerEPSS 0.9%CVE-2022-44785CRITICALAn issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, soEPSS 0.9%CVE-2024-2018HIGHWP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL InjectionEPSS 0.9%CVE-2020-27233MEDIUMAn exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attackerEPSS 0.9%CVE-2021-43926MEDIUMImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in SynoloEPSS 0.9%CVE-2021-43927MEDIUMImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in SEPSS 0.9%CVE-2023-6657MEDIUMSourceCodester Simple Student Attendance System student_form.php sql injectionEPSS 0.9%CVE-2021-43925MEDIUMImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in SynoloEPSS 0.9%CVE-2024-29875CRITICALSQL injection vulnerability in SentrifugoEPSS 0.9%CVE-2022-2468MEDIUMSourceCodester Garage Management System editbrand.php sql injectionEPSS 0.9%