VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,387)

page 790 of 1,020
  • CVE-2013-3536May 13, 2013
    Whmcs
    Group Pay
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.

  • CVE-2013-3532May 10, 2013
    Web Dorado
    Spider Video Player
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.

  • CVE-2013-3531May 10, 2013
    Radiocms
    Radiocms
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.

  • CVE-2013-3530May 10, 2013
    WordPress
    Spiffy XSPF Player
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.

  • CVE-2013-3525May 10, 2013
    Bestpractical
    Request Tracker
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that…

  • CVE-2013-0140May 1, 2013
    McAfee
    Epolicy Orchestrator
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.

  • CVE-2013-1748Apr 18, 2013
    PHP Address
    PHP Address
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) edit.php or (2) import.php. NOTE: the view.php id vector is already covered by CVE-2008-2565.1 and the edit.php id vector…

  • CVE-2013-3050Apr 12, 2013
    Zapms
    Zapms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ZAPms 1.41 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter to product.

  • CVE-2013-0135Apr 9, 2013
    PHP Address
    PHP Address
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the…

  • CVE-2013-2690Mar 28, 2013
    Synchroweb
    Synconnect
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action.

  • CVE-2011-5262Feb 12, 2013
    SonicWall
    Aventail
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in prodpage.cfm in SonicWALL Aventail allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.

  • CVE-2011-5259Feb 12, 2013
    Orangehrm
    Orangehrm
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2012-6529Jan 31, 2013
    Marinet
    Marinet CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Marinet CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) galleryphoto.php or (2) gallery.php; or the roomid parameter to (3) room.php or (4) room2.php.

  • CVE-2012-6526Jan 31, 2013
    Vastal
    Freelance Zone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show_code.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the code_id parameter.

  • CVE-2012-6525Jan 31, 2013
    Phpbridges Dev Team
    Phpbridges
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in PHPBridges allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2012-6524Jan 31, 2013
    Powie
    Pgb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-5287Jan 31, 2013
    Cornerstone Technologies
    webConductor
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.php in Cornerstone Technologies webConductor allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2012-6520Jan 24, 2013
    Wikidforum
    Wikidforum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbitrary SQL commands via the (1) select_sort or (2) opt_search_select parameters. NOTE: this issue could not be reproduced by third parties.

  • CVE-2012-6519Jan 24, 2013
    Diy CMS
    Diy CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php.

  • CVE-2012-6516Jan 24, 2013
    PHP Ticket
    PHP Ticket
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php.