VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,812)

page 21 of 1,041
  • CVE-2017-17579CriDec 13, 2017
    FS
    Freelancer Clone
    risk 0.67cvss 9.8epss 0.03

    FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.

  • CVE-2017-17578CriDec 13, 2017
    FS
    Crowdfunding Script
    risk 0.67cvss 9.8epss 0.03

    FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.

  • CVE-2017-17577CriDec 13, 2017
    FS
    Trademe Clone
    risk 0.67cvss 9.8epss 0.03

    FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter.

  • CVE-2017-17576CriDec 13, 2017
    FS Gigs Script
    FS Gigs Script
    risk 0.67cvss 9.8epss 0.03

    FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php ser parameter.

  • CVE-2017-17575CriDec 13, 2017
    Groupon Clone Project
    Groupon Clone
    risk 0.67cvss 9.8epss 0.03

    FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.

  • CVE-2017-17574CriDec 13, 2017
    FS Care
    Clone
    risk 0.67cvss 9.8epss 0.03

    FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.

  • CVE-2017-17573CriDec 13, 2017
    FS
    Ebay Clone
    risk 0.67cvss 9.8epss 0.03

    FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id parameter.

  • CVE-2017-17572CriDec 13, 2017
    FS
    Amazon Clone
    risk 0.67cvss 9.8epss 0.03

    FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.

  • CVE-2017-17571CriDec 13, 2017
    FS
    Foodpanda Clone
    risk 0.67cvss 9.8epss 0.03

    FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.

  • CVE-2017-17570CriDec 13, 2017
    FS
    Expedia Clone
    risk 0.67cvss 9.8epss 0.03

    FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_orig or fl_dest parameter.

  • CVE-2017-17111CriDec 11, 2017
    Posty
    Readymade Classifieds Script
    risk 0.67cvss 9.8epss 0.09

    Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request.

  • CVE-2017-17110CriDec 11, 2017
    Techno
    Portfolio Management Panel
    risk 0.67cvss 9.8epss 0.09

    Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

  • CVE-2015-3934CriNov 21, 2017
    Fiyo
    CMS
    risk 0.67cvss 9.8epss 0.03

    Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.

  • CVE-2015-3933CriNov 8, 2017
    Genixcms
    Genixcms
    risk 0.67cvss 9.8epss 0.04

    Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.

  • CVE-2017-16543CriNov 5, 2017
    Zohocorp
    Manageengine Applications Manager
    risk 0.67cvss 9.8epss 0.06

    Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.

  • CVE-2017-15993CriOct 31, 2017
    Zomato Clone Script Project
    Zomato Clone Script
    risk 0.67cvss 9.8epss 0.03

    Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.

  • CVE-2017-15992CriOct 31, 2017
    Website Broker Script Project
    Website Broker Script
    risk 0.67cvss 9.8epss 0.03

    Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.

  • CVE-2017-15991CriOct 31, 2017
    Vastal
    Agent Zone
    risk 0.67cvss 9.8epss 0.03

    Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951,…

  • CVE-2017-15989CriOct 31, 2017
    Online Exam Test Application Project
    Online Exam Test Application
    risk 0.67cvss 9.8epss 0.03

    Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.

  • CVE-2017-15988CriOct 31, 2017
    Nice PHP FAQ Script
    Nice PHP FAQ Script
    risk 0.67cvss 9.8epss 0.03

    Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.