CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
BaseStableLikelihood: High
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (8,799)
page 10 of 440| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-14738 | Cri | 0.67 | 9.8 | 0.06 | Sep 30, 2017 | FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search function). | |
| CVE-2017-14507 | Cri | 0.67 | 9.8 | 0.08 | Sep 29, 2017 | Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php. | |
| CVE-2017-14703 | Cri | 0.67 | 9.8 | 0.01 | Sep 26, 2017 | SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to search/. | |
| CVE-2017-12930 | Cri | 0.67 | 9.8 | 0.03 | Sep 21, 2017 | SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password. | |
| CVE-2017-14396 | Cri | 0.67 | 9.8 | 0.02 | Sep 12, 2017 | In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php. | |
| CVE-2014-9558 | Cri | 0.67 | 9.8 | 0.03 | Aug 28, 2017 | Multiple SQL injection vulnerabilities in SmartCMS v.2. | |
| CVE-2017-11494 | Cri | 0.67 | 9.8 | 0.03 | Aug 2, 2017 | SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a login action. | |
| CVE-2015-2798 | Cri | 0.67 | 9.8 | 0.01 | Jul 25, 2017 | SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
| CVE-2017-11471 | Cri | 0.67 | 9.8 | 0.01 | Jul 20, 2017 | IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter. | |
| CVE-2017-11470 | Cri | 0.67 | 9.8 | 0.01 | Jul 20, 2017 | IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the element parameter. | |
| CVE-2017-10682 | Cri | 0.67 | 9.8 | 0.00 | Jun 29, 2017 | SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php. | |
| CVE-2017-9730 | Cri | 0.67 | 9.8 | 0.01 | Jun 19, 2017 | SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the "r" parameter. | |
| CVE-2015-7346 | Cri | 0.67 | 9.8 | 0.04 | Jun 7, 2017 | SQL injection vulnerability in ZCMS 1.1. | |
| CVE-2015-7568 | Cri | 0.67 | 9.8 | 0.06 | Apr 24, 2017 | SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter. | |
| CVE-2016-4337 | Cri | 0.67 | 9.8 | 0.03 | Apr 12, 2017 | SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to execute arbitrary SQL commands via the email parameter in a recover_login action. | |
| CVE-2015-7564 | Cri | 0.67 | 9.8 | 0.02 | Apr 12, 2017 | Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php. | |
| CVE-2017-2641 | Cri | 0.67 | 9.8 | 0.02 | Mar 26, 2017 | In Moodle 2.x and 3.x, SQL injection can occur via user preferences. | |
| CVE-2017-6550 | Cri | 0.67 | 9.8 | 0.06 | Mar 20, 2017 | Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE parameter to esbus/servlet/GetSQLData or (2) QUERY parameter to KK_LS9ReportingPortal/GetData. | |
| CVE-2017-6095 | Cri | 0.67 | 9.8 | 0.07 | Feb 21, 2017 | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id. | |
| CVE-2017-5344 | Cri | 0.67 | 9.8 | 0.08 | Feb 17, 2017 | An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Overcoming these controls permits a number of blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment. |