CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (8,799)
page 376 of 440| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2007-5452 | 0.03 | — | 0.00 | Oct 14, 2007 | Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) ip or (2) t parameter. | ||
| CVE-2007-5430 | 0.03 | — | 0.02 | Oct 12, 2007 | Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in the Content Management System, (2) the id parameter in a sto cmd action to shop.php in the Merchant subsystem, or the (3) course or (4) provider parameter to detail.php in the Courses subsystem. | ||
| CVE-2007-5408 | 0.03 | — | 0.00 | Oct 12, 2007 | SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category parameter. | ||
| CVE-2007-5316 | 0.03 | — | 0.01 | Oct 9, 2007 | SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL commands via the cid parameter. | ||
| CVE-2007-5308 | 0.03 | — | 0.01 | Oct 9, 2007 | SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action. | ||
| CVE-2007-5272 | 0.03 | — | 0.00 | Oct 8, 2007 | SQL injection vulnerability in kategori.asp in Furkan Tastan Blog allows remote attackers to execute arbitrary SQL commands via the id parameter in a goster kat action. | ||
| CVE-2007-5261 | 0.03 | — | 0.00 | Oct 6, 2007 | Multiple SQL injection vulnerabilities in MultiCart 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to categorydetail.php and the (2) ddlCategory parameter to search.php. | ||
| CVE-2007-5233 | 0.03 | — | 0.00 | Oct 5, 2007 | SQL injection vulnerability in index.php in Web Template Management System 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a readmore action. | ||
| CVE-2007-5222 | 0.03 | — | 0.02 | Oct 5, 2007 | SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header. | ||
| CVE-2007-5177 | 0.03 | — | 0.01 | Oct 3, 2007 | SQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allows remote attackers to execute arbitrary SQL commands via the caid parameter. | ||
| CVE-2007-5187 | 0.03 | — | 0.01 | Oct 3, 2007 | SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the sel parameter. | ||
| CVE-2007-5181 | 0.03 | — | 0.01 | Oct 3, 2007 | SQL injection vulnerability in detay.asp in Netkamp Emlak Scripti allows remote attackers to execute arbitrary SQL commands via the ilan_id parameter. | ||
| CVE-2007-5180 | 0.03 | — | 0.02 | Oct 3, 2007 | Multiple SQL injection vulnerabilities in Ohesa Emlak Portali allow remote attackers to execute arbitrary SQL commands via the (1) Kategori parameter in satilik.asp and the (2) Emlak parameter in detay.asp. | ||
| CVE-2007-5131 | 0.03 | — | 0.01 | Sep 27, 2007 | SQL injection vulnerability in index.php in Interspire ActiveKB NX 2.x allows remote attackers to execute arbitrary SQL commands via the catId parameter in a browse action. NOTE: it was separately reported that ActiveKB 1.5 is also affected. | ||
| CVE-2007-5122 | 0.03 | — | 0.01 | Sep 27, 2007 | SQL injection vulnerability in store_info.php in SoftBiz Classifieds PLUS allows remote attackers to execute arbitrary SQL commands via the id parameter. | ||
| CVE-2007-5123 | 0.03 | — | 0.01 | Sep 27, 2007 | SQL injection vulnerability in notas.asp in Novus 1.0 allows remote attackers to execute arbitrary SQL commands via the nota_id parameter. | ||
| CVE-2007-5068 | 0.03 | — | 0.01 | Sep 24, 2007 | SQL injection vulnerability in index.php in phpFullAnnu (PFA) 6.0 allows remote attackers to execute arbitrary SQL commands via the mod parameter. | ||
| CVE-2007-5061 | 0.03 | — | 0.01 | Sep 24, 2007 | SQL injection vulnerability in mods/banners/navlist.php in Clansphere 2007.4 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php in a banners action. | ||
| CVE-2007-5016 | 0.03 | — | 0.01 | Sep 20, 2007 | SQL injection vulnerability in userreviews.php in OneCMS 2.4 allows remote attackers to execute arbitrary SQL commands via the abc parameter. | ||
| CVE-2007-4984 | 0.03 | — | 0.01 | Sep 19, 2007 | SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for phpBB 2.0.xx allows remote attackers to execute arbitrary SQL commands via the s parameter. |
- CVE-2007-5452Oct 14, 2007risk 0.03cvss —epss 0.00
Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) ip or (2) t parameter.
- CVE-2007-5430Oct 12, 2007risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in the Content Management System, (2) the id parameter in a sto cmd action to shop.php in the Merchant subsystem, or the (3) course or (4) provider parameter to detail.php in the Courses subsystem.
- CVE-2007-5408Oct 12, 2007risk 0.03cvss —epss 0.00
SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category parameter.
- CVE-2007-5316Oct 9, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
- CVE-2007-5308Oct 9, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.
- CVE-2007-5272Oct 8, 2007risk 0.03cvss —epss 0.00
SQL injection vulnerability in kategori.asp in Furkan Tastan Blog allows remote attackers to execute arbitrary SQL commands via the id parameter in a goster kat action.
- CVE-2007-5261Oct 6, 2007risk 0.03cvss —epss 0.00
Multiple SQL injection vulnerabilities in MultiCart 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to categorydetail.php and the (2) ddlCategory parameter to search.php.
- CVE-2007-5233Oct 5, 2007risk 0.03cvss —epss 0.00
SQL injection vulnerability in index.php in Web Template Management System 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a readmore action.
- CVE-2007-5222Oct 5, 2007risk 0.03cvss —epss 0.02
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header.
- CVE-2007-5177Oct 3, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allows remote attackers to execute arbitrary SQL commands via the caid parameter.
- CVE-2007-5187Oct 3, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the sel parameter.
- CVE-2007-5181Oct 3, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in detay.asp in Netkamp Emlak Scripti allows remote attackers to execute arbitrary SQL commands via the ilan_id parameter.
- CVE-2007-5180Oct 3, 2007risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Ohesa Emlak Portali allow remote attackers to execute arbitrary SQL commands via the (1) Kategori parameter in satilik.asp and the (2) Emlak parameter in detay.asp.
- CVE-2007-5131Sep 27, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in Interspire ActiveKB NX 2.x allows remote attackers to execute arbitrary SQL commands via the catId parameter in a browse action. NOTE: it was separately reported that ActiveKB 1.5 is also affected.
- CVE-2007-5122Sep 27, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in store_info.php in SoftBiz Classifieds PLUS allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2007-5123Sep 27, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in notas.asp in Novus 1.0 allows remote attackers to execute arbitrary SQL commands via the nota_id parameter.
- CVE-2007-5068Sep 24, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in phpFullAnnu (PFA) 6.0 allows remote attackers to execute arbitrary SQL commands via the mod parameter.
- CVE-2007-5061Sep 24, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in mods/banners/navlist.php in Clansphere 2007.4 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php in a banners action.
- CVE-2007-5016Sep 20, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in userreviews.php in OneCMS 2.4 allows remote attackers to execute arbitrary SQL commands via the abc parameter.
- CVE-2007-4984Sep 19, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for phpBB 2.0.xx allows remote attackers to execute arbitrary SQL commands via the s parameter.