Falhas do tipo CWE-89

12.846 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2022-1372CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows aEPSS 1.2%CVE-2022-26514CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_tagHandler.ashxEPSS 1.2%CVE-2020-7577—A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Through thEPSS 1.2%CVE-2022-1374CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This EPSS 1.2%CVE-2022-26059CRITICALDelta Electronics DIAEnergie SQL Injection in GetQueryDataEPSS 1.2%CVE-2022-1375CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. ThiEPSS 1.2%CVE-2022-26666CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashxEPSS 1.2%CVE-2022-26069CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerPage_KID.ashxEPSS 1.2%CVE-2022-26836CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashxEPSS 1.2%CVE-2022-1371CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. This allows an aEPSS 1.2%CVE-2022-27175CRITICALDelta Electronics DIAEnergie SQL Injection in GetCalcTagListEPSS 1.2%CVE-2022-1377CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. ThisEPSS 1.2%CVE-2022-25980CRITICALDelta Electronics DIAEnergie SQL Injection in HandlerCommon.ashxEPSS 1.2%CVE-2022-1369CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. This allows anEPSS 1.2%CVE-2022-25880CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashxEPSS 1.2%CVE-2022-26667CRITICALDelta Electronics DIAEnergie SQL Injection in GetDemandAnalysisDataEPSS 1.2%CVE-2022-26065CRITICALDelta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisDataEPSS 1.2%CVE-2022-26349CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashxEPSS 1.2%CVE-2022-1370CRITICALDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows aEPSS 1.2%CVE-2024-13478HIGHLTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL InjectionEPSS 1.2%