Falhas do tipo CWE-89

12.881 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2023-41542CRITICALSQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information viaEPSS 0.9%CVE-2023-28438MEDIUMPimcore vulnerable to improper quoting of filters in Custom ReportsEPSS 0.9%CVE-2024-29870CRITICALSQL injection vulnerability in SentrifugoEPSS 0.9%CVE-2022-2812HIGHSourceCodester Guest Management System index.php sql injectionEPSS 0.9%CVE-2023-28108HIGHPimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID ModelEPSS 0.9%CVE-2022-1839MEDIUMHome Clean Services Management System login.php sql injectionEPSS 0.9%CVE-2022-44151CRITICALSimple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php.EPSS 0.9%CVE-2021-36503CRITICALSQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php fEPSS 0.9%CVE-2021-41187HIGHSQL Injection in DHIS2 Tracker APIEPSS 0.9%CVE-2023-23459CRITICALPriority Windows – Command Execution via SQL Injection EPSS 0.9%CVE-2023-40046HIGHWS_FTP Server SQL Injection via Administrative InterfaceEPSS 0.9%CVE-2022-4151MEDIUMContest Gallery < 19.1.5 - Admin+ SQL InjectionEPSS 0.9%CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2021-36432HIGHSQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_maskEPSS 0.9%CVE-2020-36859HIGHNagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit PagesEPSS 0.9%CVE-2026-45779CRITICALOpen XDMoD Vulnerable to Unauthenticated SQL Injection Leading to Full Database CompromiseEPSS 0.9%CVE-2023-30867—Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerabilityEPSS 0.9%CVE-2024-3349HIGHSourceCodester Aplaya Beach Resort Online Reservation System login.php sql injectionEPSS 0.9%CVE-2024-11649MEDIUM1000 Projects Beauty Parlour Management System search-appointment.php sql injectionEPSS 0.9%CVE-2024-3439HIGHSourceCodester Prison Management System login.php sql injectionEPSS 0.9%