VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,812)

page 14 of 1,041
  • CVE-2018-10969CriJun 17, 2018
    WordPress
    Pie Register
    risk 0.67cvss 9.8epss 0.05

    SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.

  • CVE-2018-12055CriJun 8, 2018
    PHP Scripts Mall
    Schools Alert Management Script
    risk 0.67cvss 9.8epss 0.03

    Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.php, faq.php, about.php, photo_gallery.php, privacy.php, and so on.

  • CVE-2018-12052CriJun 8, 2018
    PHP Scripts Mall
    Schools Alert Management Script
    risk 0.67cvss 9.8epss 0.05

    SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.

  • CVE-2016-9488CriJun 5, 2018
    Manageengine
    Applications Manager
    risk 0.67cvss 9.8epss 0.05

    ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users'…

  • CVE-2018-11535CriMay 29, 2018
    SITEMAKIN
    SLAC
    risk 0.67cvss 9.8epss 0.03

    An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.

  • CVE-2018-6410CriMay 26, 2018
    Machform
    Machform
    risk 0.67cvss 9.8epss 0.05

    An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.

  • CVE-2018-11444CriMay 25, 2018
    Easyservice Billing Project
    Easyservice Billing
    risk 0.67cvss 9.8epss 0.03

    A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.

  • CVE-2018-9245CriApr 22, 2018
    Ericssonlg
    Ipecs Nms
    risk 0.67cvss 9.8epss 0.04

    The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypass the login page and execute remote code on the operating system.

  • CVE-2018-7474CriMar 14, 2018
    Textpattern
    Textpattern
    risk 0.67cvss 9.8epss 0.06

    An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.

  • CVE-2018-7538CriMar 12, 2018
    Enalean
    Tuleap
    risk 0.67cvss 9.8epss 0.04

    A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands.

  • CVE-2018-7477CriFeb 28, 2018
    School Management Script Project
    School Management Script
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php.

  • CVE-2018-7319CriFeb 22, 2018
    Joomla
    OS Property Real Estate
    risk 0.67cvss 9.8epss 0.02

    SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.

  • CVE-2018-7318CriFeb 22, 2018
    Joomla
    CheckList
    risk 0.67cvss 9.8epss 0.09

    SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.

  • CVE-2018-7315CriFeb 22, 2018
    Harmistechnology
    Ek Rishta
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter.

  • CVE-2018-7312CriFeb 22, 2018
    Joomla
    Alexandria Book Library
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.

  • CVE-2018-6024CriFeb 18, 2018
    Joomla
    Project Log
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.

  • CVE-2018-7180CriFeb 17, 2018
    Saxum2003
    Astro
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.

  • CVE-2018-7179CriFeb 17, 2018
    Joomla
    SquadManagement
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.

  • CVE-2018-7178CriFeb 17, 2018
    Saxum
    Picker
    risk 0.67cvss 9.8epss 0.04

    SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.

  • CVE-2018-7177CriFeb 17, 2018
    Joomla
    Saxum Numerology
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.