VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (12,807)

page 639 of 641
  • CVE-2006-0692Feb 15, 2006
    Carey Briggs
    PHP Mysql Timesheet
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the (1) yr, (2) month, (3) day, and (4) job parameters in (a) index.php and (b) changehrs.php.

  • CVE-2006-0602Feb 8, 2006
    Hinton Design
    Phphg Guestbook
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Hinton Design phphg Guestbook 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to check.php or the id parameter to (2) admin/edit_smilie.php, (3) admin/add_theme.php, (4) admin/ban_ip.php, (5)…

  • CVE-2006-0412Jan 25, 2006
    Gencbeyin Web Programlama
    Cybershop
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.

  • CVE-2006-0403Jan 25, 2006
    E Moblog
    E Moblog
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) monthy parameter to index.php or (2) login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but…

  • CVE-2006-0269Jan 18, 2006
    Oracle Corporation
    Oracle10g
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Streams Capture component of Oracle Database server 10.1.0.5 and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB25. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a…

  • CVE-2006-0205Jan 13, 2006
    Wordcircle
    Wordcircle
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via…

  • CVE-2006-0192Jan 13, 2006
    ASPSurvey
    ASPSurvey
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.

  • CVE-2006-0159Jan 10, 2006
    Javier Suarez Sanz
    Foro Domus
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown, although it may be based on post-disclosure analysis of CVE-2006-0110; the…

  • CVE-2005-4606Dec 31, 2005
    Webwiz
    Database Login
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login 1.71 and earlier allows remote attackers to execute arbitrary SQL commands via…

  • CVE-2005-4711Dec 31, 2005
    Neocrome
    Land Down Under
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Neocrome Land Down Under (LDU) 801 allows remote attackers to execute arbitrary SQL commands via an HTTP Referer header. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2005-4632Dec 31, 2005
    Vote Pro
    Vote Pro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in poll_frame.php in Vote! Pro 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.

  • CVE-2005-4617Dec 31, 2005
    Forperfect
    Csupport
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in tickets.php in cSupport 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pg parameter.

  • CVE-2005-4515Dec 23, 2005
    Lois Software
    Webdb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in WebDB 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search parameters, possibly Search0. NOTE: the vendor has disputed this issue, saying that "WebDB is a generic online database system used by many of…

  • CVE-2005-4495Dec 22, 2005
    Spiremedia
    Mx7
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.cfm in SpireMedia mx7 allows remote attackers to execute arbitrary SQL commands via the cid parameter. NOTE: the vendor has disputed this issue, stating "This information is incorrect, unproven, and potentially slanderous." However, CVE and…

  • CVE-2005-4382Dec 20, 2005
    Citysoft
    Community Enterprise
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in CitySoft Community Enterprise 4.x allows remote attackers to execute arbitrary SQL commands via the (1) nodeID, (2) pageID, (3) ID, and (4) parentid parameter to index.cfm; and (5) documentFormatId parameter to document/docWindow.cfm.

  • CVE-2005-4315Dec 17, 2005
    Plexum
    PLEXCART X3
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the search function in Plexum PLEXCART X3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly involving the (1) s_itemname and (2) s_orderby parameters to plexcart.pl.

  • CVE-2005-4199Dec 13, 2005
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options…

  • CVE-2005-4058Dec 7, 2005
    Saralblog
    Saralblog
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in saralblog 1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to viewprofile.php.

  • CVE-2005-4040Dec 6, 2005
    FileLister
    FileLister
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in FileLister 0.51 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameters, possibly the searchwhat parameter to definesearch.jsp.

  • CVE-2005-4027Dec 5, 2005
    SimpleBBS
    SimpleBBS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in SimpleBBS 1.1 allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.