Falhas do tipo CWE-89

12.895 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2023-2074MEDIUMCampcodes Online Traffic Offense Management System Master.php sql injectionEPSS 0.8%CVE-2023-5466HIGHWp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-43794MEDIUMSQL Injection in nocodbEPSS 0.8%CVE-2022-29822CRITICALFeathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injectionEPSS 0.8%CVE-2023-2037MEDIUMCampcodes Video Sharing Website watch.php sql injectionEPSS 0.8%CVE-2023-1039HIGHSourceCodester Class and Exam Timetabling System POST Parameter index3.php sql injectionEPSS 0.8%CVE-2022-2422CRITICALFeathers - SQL injection via attribute aliasesEPSS 0.8%CVE-2023-1301MEDIUMSourceCodester Friendly Island Pizza Website and Ordering System GET Parameter deleteorder.php sql injectionEPSS 0.8%CVE-2023-2366MEDIUMSourceCodester Faculty Evaluation System sql injectionEPSS 0.8%CVE-2023-1300MEDIUMSourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injectionEPSS 0.8%CVE-2023-5428HIGHImage vertical reel scroll slideshow <= 9.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-30850HIGHPimcore SQL Injection Vulnerability in Admin Translations APIEPSS 0.8%CVE-2023-30849HIGHPimcore vulnerable to SQL Injection in Translation Export APIEPSS 0.8%CVE-2026-9668MEDIUMSQL injection vulnerability in ZTE SCP productEPSS 0.8%CVE-2024-31010HIGHSQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.EPSS 0.8%CVE-2023-1311MEDIUMSourceCodester Friendly Island Pizza Website and Ordering System GET Parameter large.php sql injectionEPSS 0.8%CVE-2023-5433HIGHMessage ticker <= 9.2 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5429HIGHInformation Reel <= 10.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5430HIGHJquery news ticker <= 3.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5438HIGHwp image slideshow <= 12.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%