VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,812)

page 16 of 1,041
  • CVE-2018-5975CriFeb 17, 2018
    Joomla
    Smart Shoutbox
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.

  • CVE-2018-5974CriFeb 17, 2018
    Joomla
    SimpleCalendar
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.

  • CVE-2018-5971CriFeb 17, 2018
    Joomla
    MediaLibrary Free
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter.

  • CVE-2018-5970CriFeb 17, 2018
    Joomla
    JGive
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter.

  • CVE-2018-6609CriFeb 5, 2018
    Joomla
    JSP Tickets
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a statuslist (or prioritylist) edit action.

  • CVE-2018-6604CriFeb 5, 2018
    Zh Yandexmap Project
    Zh Yandexmap
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request.

  • CVE-2018-6582CriFeb 5, 2018
    Zh Googlemap Project
    Zh Googlemap
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.

  • CVE-2018-6581CriFeb 2, 2018
    Joomla
    JMS Music
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.

  • CVE-2018-6579CriFeb 2, 2018
    Jextn
    Reverse Auction
    risk 0.67cvss 9.8epss 0.04

    SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.

  • CVE-2018-6578CriFeb 2, 2018
    Jextn
    Je Paypervideo
    risk 0.67cvss 9.8epss 0.04

    SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.

  • CVE-2018-6577CriFeb 2, 2018
    Jextn
    Membership
    risk 0.67cvss 9.8epss 0.02

    SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.

  • CVE-2018-6576CriFeb 2, 2018
    Ezcode
    Event Manager
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.

  • CVE-2018-6575CriFeb 2, 2018
    Jextn
    Classified
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.

  • CVE-2018-6398CriJan 30, 2018
    Joomla
    CP Event Calendar
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.

  • CVE-2018-6395CriJan 30, 2018
    Joomla
    Visual Calendar
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.

  • CVE-2018-6367CriJan 29, 2018
    Vastal
    Buddy Zone Facebook Clone
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter.

  • CVE-2018-6365CriJan 29, 2018
    Datacomponents
    Tsitebuilder
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.

  • CVE-2018-6364CriJan 29, 2018
    Multilanguage Real Estate Mlm Script Project
    Multilanguage Real Estate Mlm Script
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.

  • CVE-2018-6363CriJan 29, 2018
    Taskrabbit Clone Project
    Taskrabbit Clone
    risk 0.67cvss 9.8epss 0.03

    SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.

  • CVE-2017-1000474CriJan 24, 2018
    Vehicle Sales Management System Project
    Vehicle Sales Management System
    risk 0.67cvss 9.8epss 0.02

    Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/vehicle.php, login/profile.php, login/Actions.php, login/manage_employee.php, and login/sell.php scripts resulting in the expose of user's login credentials, SQL…