Falhas do tipo CWE-89

12.895 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2024-13483HIGHLTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL InjectionEPSS 0.8%CVE-2024-6653MEDIUMcode-projects Simple Task List Login loginForm.php sql injectionEPSS 0.8%CVE-2021-38732CRITICALSEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.EPSS 0.8%CVE-2026-37749CRITICALA SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authenEPSS 0.8%CVE-2023-6617MEDIUMSourceCodester Simple Student Attendance System attendance.php sql injectionEPSS 0.8%CVE-2023-6619MEDIUMSourceCodester Simple Student Attendance System class_form.php sql injectionEPSS 0.8%CVE-2023-6464MEDIUMSourceCodester User Registration and Login System add-user.php sql injectionEPSS 0.8%CVE-2024-3085HIGHPHPGurukul Emergency Ambulance Hiring Portal Admin Login Page login.php sql injectionEPSS 0.8%CVE-2024-43436HIGHMoodle: site administration sql injection via xmldb editorEPSS 0.8%CVE-2023-4833CRITICALSQLi in Besttem's Network Marketing SoftwareEPSS 0.8%CVE-2023-1564MEDIUMSourceCodester Air Cargo Management System GET Parameter update_status.php sql injectionEPSS 0.8%CVE-2023-6306MEDIUMSourceCodester Free and Open Source Inventory Management System member_data.php sql injectionEPSS 0.8%CVE-2022-1690—Note Press <= 0.1.10 - Admin+ SQLi via Bulk ActionsEPSS 0.8%CVE-2022-1688—Note Press <= 0.1.10 - Admin+ SQLi via idEPSS 0.8%CVE-2022-1686—Five Minute Webshop <= 1.3.2 - Admin+ SQLi via idEPSS 0.8%CVE-2022-1684—Cube Slider <= 1.2 - Admin+ SQLiEPSS 0.8%CVE-2022-1687—Logo Slider <= 1.4.8 - Admin+ SQLiEPSS 0.8%CVE-2023-5634CRITICALSQLi in ArslanSoft's Education PortalEPSS 0.8%CVE-2024-3771MEDIUMPHPGurukul Student Record System edit-subject.php sql injectionEPSS 0.8%CVE-2023-3008HIGHningzichun Student Management System login.php sql injectionEPSS 0.8%