VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,387)

page 786 of 1,020
  • CVE-2014-3934Jun 2, 2014
    PHP-Nuke
    Submit_News
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] parameter to modules.php.

  • CVE-2014-3415May 29, 2014
    Sharetronix
    Sharetronix
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL commands via the invite_users[] parameter to the /invite page for a group.

  • CVE-2014-3871May 27, 2014
    Geodesicsolutions
    Geocore Max
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) allow remote attackers to execute arbitrary SQL commands via the (1) c[password] or (2) c[username] parameter. NOTE: the b parameter to…

  • CVE-2014-3210May 22, 2014
    WordPress
    Booking System
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.

  • CVE-2014-3749May 20, 2014
    Construtiva
    Cis Manager CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Construtiva CIS Manager allows remote attackers to execute arbitrary SQL commands via the email parameter to autenticar/lembrarlogin.asp.

  • CVE-2014-3757May 15, 2014
    Phpmanufaktur
    Kitform
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in sorter.php in the phpManufaktur kitForm extension 0.43 and earlier for the KeepInTouch (KIT) module allows remote attackers to execute arbitrary SQL commands via the sorter_value parameter.

  • CVE-2013-2226May 14, 2014
    Glpi Project
    Glpi
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to…

  • CVE-2014-3246May 13, 2014
    Collabtive
    Collabtive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileview_list action to manageajax.php.

  • CVE-2014-2934May 8, 2014
    Caldera
    Caldera
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php.

  • CVE-2013-7375May 5, 2014
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.

  • CVE-2013-1803May 5, 2014
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2)…

  • CVE-2014-3138May 2, 2014
    Xerox
    Docushare
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/.…

  • CVE-2014-2847Apr 11, 2014
    Construtiva
    Cis Manager CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter.

  • CVE-2014-2540Apr 11, 2014
    Orbitscripts
    Orbit Open AD Server
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory.

  • CVE-2012-6643Apr 8, 2014
    Clip Bucket
    Clipbucket
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to (1) videos.php or (2) channels.php. NOTE: some of these details are obtained from…

  • CVE-2011-5278Apr 8, 2014
    MyBB
    Advanced Forum Signatures
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in signature.php in Advanced Forum Signatures plugin (aka afsignatures) 2.0.4 for MyBB allows remote attackers to execute arbitrary SQL commands via the afs_bar_right parameter.

  • CVE-2011-5277Apr 8, 2014
    MyBB
    Advanced Forum Signatures
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4 for MyBB allow remote attackers to execute arbitrary SQL commands via the (1) afs_type, (2) afs_background, (3) afs_showonline, (4) afs_bar_left, (5)…

  • CVE-2013-2945Apr 2, 2014
    B2evolution
    B2evolution
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute…

  • CVE-2013-3213Apr 2, 2014
    Vtiger
    CRM
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name parameter in the get_picklists method to soap/customerportal.php, (2) where parameter in the get_tickets_list method to…

  • CVE-2013-7349Apr 1, 2014
    Raoul Proenca
    Gnew
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter to news/send.php, (2) thread_id parameter to posts/edit.php, or (3) user_email parameter to users/password.php or (4) users/register.php. …