Falhas do tipo CWE-89

12.845 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2023-0913MEDIUMSourceCodester Auto Dealer Management System sql injectionEPSS 1.6%CVE-2018-7501—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 1.6%CVE-2021-25070—WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLiEPSS 1.6%CVE-2021-24303—JiangQie Official Website Mini Program < 1.1.1 - Authenticated SQL InjectionEPSS 1.6%CVE-2021-25007—MOLIE <= 0.5 - Authenticated SQL InjectionEPSS 1.6%CVE-2017-6757—A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated,EPSS 1.6%CVE-2022-0771—SiteSuperCharger < 5.2.0 - Unauthenticated SQLiEPSS 1.6%CVE-2025-27709HIGHSQL InjectionEPSS 1.6%CVE-2019-15972MEDIUMCisco Unified Communications Manager SQL Injection VulnerabilityEPSS 1.6%CVE-2025-36528HIGHSQL InjectionEPSS 1.6%CVE-2025-41444HIGHSQL InjectionEPSS 1.6%CVE-2019-5112HIGHExploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameteEPSS 1.6%CVE-2021-24492—Handsome Testimonials & Reviews < 2.1.1 - Authenticated (Subscriber+) SQL InjectionEPSS 1.6%CVE-2023-31038HIGHApache Log4cxx: SQL injection when using ODBC appenderEPSS 1.6%CVE-2024-35181MEDIUMGHSL-2024-013 Meshery SQL Injection vulnerabilityEPSS 1.6%CVE-2022-32456CRITICALData Systems Consulting Co., Ltd. BPM - SQL InjectionEPSS 1.6%CVE-2023-26034CRITICALZoneMinder SQL InjectionEPSS 1.6%CVE-2022-44003CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerableEPSS 1.6%CVE-2014-5399—Schneider Electric Wonderware SQL InjectionEPSS 1.6%CVE-2021-24521—Side Menu Lite < 2.2.1 - Authenticated SQL InjectionEPSS 1.6%