VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,295)

page 800 of 1,015
  • CVE-2011-0960May 20, 2011
    Cisco Systems, Inc.
    Unified Operations Manager
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to execute arbitrary SQL commands via (1) the CCMs parameter to iptm/PRTestCreation.do or (2) the ccm parameter to iptm/TelePresenceReportAction.do, aka Bug ID…

  • CVE-2010-4800Apr 27, 2011
    Baconmap
    Baconmap
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in doadd.php in BaconMap 1.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.

  • CVE-2010-4799Apr 27, 2011
    Chipmunk Scripts
    Pwngame
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to authenticate.php and the (3) ID parameter to pwn.php. NOTE: some of…

  • CVE-2010-4797Apr 27, 2011
    Truworthit
    Flex Timesheet
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.

  • CVE-2010-4795Apr 27, 2011
    Joomla
    JS Calendar
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the ev_id parameter in a details action to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2010-4793Apr 27, 2011
    Site2nite
    Auto E Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in Site2Nite Auto e-Manager allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2010-4791Apr 27, 2011
    PHP-Fusion
    MG User-Fotoalbum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user_fotoalbum_panel) module 1.0.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the album_id parameter.

  • CVE-2011-1667Apr 10, 2011
    Anzeigenmarkt
    Anzeigenmarkt 2011
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Anzeigenmarkt 2011 allows remote attackers to execute arbitrary SQL commands via the q parameter in a list action.

  • CVE-2010-4784Apr 7, 2011
    PHP Web Scripts
    Easy Banner Free
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2010-4782Apr 7, 2011
    Softwebs Nepal
    Ananda Real Estate
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) city, (2) state, (3) country, (4) minprice, (5) maxprice, (6) bed, and (7) bath parameters,…

  • CVE-2010-4780Apr 7, 2011
    Enanocms
    Enanocms
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2 allows remote attackers to execute arbitrary SQL commands via the email parameter to index.php. …

  • CVE-2011-1557Apr 4, 2011
    Icloudcenter
    Icjobsite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ICloudCenter ICJobSite 1.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter to an unspecified component, a different vulnerability than CVE-2011-1546. NOTE: the provenance of this information is unknown; the details…

  • CVE-2011-1556Apr 4, 2011
    Andy's PHP Knowledgebase
    Andy's PHP Knowledgebase
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote attackers to execute arbitrary SQL commands via the pdfa parameter.

  • CVE-2011-1546Apr 4, 2011
    Andy's PHP Knowledgebase
    Aphpkb
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.3 allow remote attackers to execute arbitrary SQL commands via the s parameter to (1) a_viewusers.php or (2) keysearch.php; and allow remote authenticated administrators to execute arbitrary…

  • CVE-2010-4776Mar 23, 2011
    Preprojects
    Pre Online Tests Generator
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter.

  • CVE-2010-4774Mar 23, 2011
    Auracms
    Auracms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pdf.php in AuraCMS 1.62 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-4804 and CVE-2007-4171.

  • CVE-2010-4771Mar 23, 2011
    Matteoiammarrone
    S CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability to viewforum.php in S-CMS 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4770Mar 23, 2011
    Commodityrentals
    Dvd Rentals Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CommodityRentals DVD Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action.

  • CVE-2010-4752Mar 1, 2011
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485. NOTE: the provenance…

  • CVE-2010-4751Mar 1, 2011
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the id parameter in an edituser action, a different vector than CVE-2008-6593, CVE-2010-3484, and…