Falhas do tipo CWE-89

12.839 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2021-39179HIGHSQL Injection in DHIS2 Tracker APIEPSS 1.9%CVE-2024-31820CRITICALAn issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitraryEPSS 1.9%CVE-2016-10554—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.9%CVE-2016-10550—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.9%CVE-2021-24551—Edit Comments <= 0.3 - Unauthenticated SQL InjectionEPSS 1.9%CVE-2023-5350MEDIUMSQL Injection in salesagility/suitecrmEPSS 1.9%CVE-2026-46670CRITICALYesWiki: Unauthenticated SQL InjectionEPSS 1.9%CVE-2020-7500—A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and TEPSS 1.9%CVE-2021-1247HIGHCisco Data Center Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2021-23214—When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle aEPSS 1.9%CVE-2022-30004CRITICALSourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to EPSS 1.9%CVE-2021-24221—Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcodeEPSS 1.9%CVE-2022-2067HIGHSQL Injection in francoisjacquet/rosariosisEPSS 1.9%CVE-2019-18234—Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely execute arbitrary codEPSS 1.9%CVE-2021-1248HIGHCisco Data Center Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2023-0961MEDIUMSourceCodester Music Gallery Site GET Request view_music_details.php sql injectionEPSS 1.9%CVE-2022-1505CRITICALRSVPMaker <= 9.2.6 - Unauthenticated SQL InjectionEPSS 1.9%CVE-2026-41640HIGHNocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager LoadingEPSS 1.9%CVE-2021-43863HIGHSQL Injection in FileContentProvider (GHSL-2021-1007)EPSS 1.9%CVE-2023-45826MEDIUMAuthenticated SQL Injection in leantimeEPSS 1.9%