Falhas do tipo CWE-89
12.896 resultadosInjeção de SQL
Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.
Exemplo
Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.
Como mitigar
Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.
CVE-2022-43049HIGHCanteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php.EPSS 0.8%CVE-2022-43292HIGHCanteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editfood.php.EPSS 0.8%CVE-2022-43124HIGHOnline Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=usEPSS 0.8%CVE-2020-21152CRITICALSQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunctioEPSS 0.8%CVE-2022-43052HIGHOnline Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/EPSS 0.8%CVE-2022-43291HIGHCanteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editclient.php.EPSS 0.8%CVE-2022-43276HIGHCanteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /php_action/fetchSelecEPSS 0.8%CVE-2022-44402HIGHAutomotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.EPSS 0.8%CVE-2023-4987MEDIUMinfinitietech taskhub GET Parameter get_tasks_list sql injectionEPSS 0.8%CVE-2023-28491MEDIUMWordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL InjectionEPSS 0.8%CVE-2022-43179HIGHOnline Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&EPSS 0.8%CVE-2022-43062HIGHOnline Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/MasterEPSS 0.8%CVE-2022-43126HIGHOnline Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/tests/maEPSS 0.8%CVE-2022-44859HIGHAutomotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/admin/products/EPSS 0.8%CVE-2022-42984CRITICALWoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=seEPSS 0.8%CVE-2022-43127HIGHOnline Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/uEPSS 0.8%CVE-2022-44278HIGHSanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=.EPSS 0.8%CVE-2022-43063HIGHOnline Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.EPSS 0.8%CVE-2022-43278HIGHCanteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the categoriesId parameter at /php_action/fetchSeEPSS 0.8%CVE-2022-43290HIGHCanteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editcategory.php.EPSS 0.8%