VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,387)

page 781 of 1,020
  • CVE-2015-1372Jan 27, 2015
    Ferretcms Project
    Ferretcms
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php.

  • CVE-2015-1364Jan 27, 2015
    Freereprintables
    Articlefr
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.

  • CVE-2014-7289Jan 21, 2015
    Symantec
    Data Center Security
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary SQL commands via a crafted…

  • CVE-2014-10038Jan 13, 2015
    Domphp
    Domphp
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitrary SQL commands via the ids parameter.

  • CVE-2014-10034Jan 13, 2015
    Couponphp
    Couponphp
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/.

  • CVE-2014-10032Jan 13, 2015
    Taboada
    MacroNews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news_popup.php in Taboada MacroNews 1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

  • CVE-2014-100031Jan 13, 2015
    Ganesha Digital Library Project
    Ganesha Digital Library
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) download.php or (2) main.php.

  • CVE-2014-100020Jan 13, 2015
    Itech
    Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter. NOTE: the CatID parameter is already covered by CVE-2008-0685.

  • CVE-2014-100012Jan 13, 2015
    Sendy
    Sendy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in /app in Sendy 1.1.8.4 allows remote attackers to execute arbitrary SQL commands via the i parameter.

  • CVE-2014-100011Jan 13, 2015
    Sendy
    Sendy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via the c parameter.

  • CVE-2014-10029Jan 13, 2015
    Fluxbb
    Fluxbb
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.

  • CVE-2014-10023Jan 13, 2015
    Topicsviewer
    Topicsviewer
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) edit_block.php, (2) edit_cat.php, (3) edit_note.php, or (4) rmv_topic.php in admincp/.

  • CVE-2014-10020Jan 13, 2015
    SIMPLE
    e-document
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2014-10015Jan 13, 2015
    Phpjabbers
    Event Booking Calendar
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2014-10013Jan 13, 2015
    WordPress
    Another Wordpress Classifieds Plugin
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action.

  • CVE-2014-100003Jan 13, 2015
    WordPress
    YourMembers
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ym_download_id parameter to the default URI.

  • CVE-2015-0919Jan 8, 2015
    Sefrengo
    Sefrengo
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.

  • CVE-2010-5317Jan 3, 2015
    SweetRice
    SweetRice CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via (1) the file_name parameter in an attachment action, (2) the post parameter in a show_comment action, (3) the sys-name parameter in an…

  • CVE-2014-9457Jan 2, 2015
    Pmb Services
    Pmb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the id parameter to catalog.php.

  • CVE-2014-9445Jan 2, 2015
    Installatron
    Gatequest File Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks by creating a file that…