VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,295)

page 803 of 1,015
  • CVE-2010-4356Dec 1, 2010
    Site2nite
    Big Truck Broker
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news_default.asp in Site2Nite Big Truck Broker allows remote attackers to execute arbitrary SQL commands via the txtSiteId parameter.

  • CVE-2008-7267Dec 1, 2010
    SiteEngine
    SiteEngine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4298Nov 26, 2010
    Free Simple Software
    download module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via the downloads_id parameter in a download_now action to index.php.

  • CVE-2010-4273Nov 17, 2010
    DescargarVista
    ACC IMoveis
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in imoveis.php in DescargarVista ACC IMoveis 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4272Nov 17, 2010
    Pulse Infotech
    Sponsor Wall
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2010-4269Nov 17, 2010
    Collabtive
    Collabtive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL commands via the chatstart[USERTOID] cookie in a pull action.

  • CVE-2010-4268Nov 17, 2010
    Joomla
    Pulse Infotech Flip Wall
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Pulse Infotech Flip Wall (com_flipwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2010-4186Nov 5, 2010
    Onlinetechtools.com
    Online Work Order System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-4185Nov 5, 2010
    Energine
    Energine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Energine, possibly 2.3.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the NRGNSID cookie.

  • CVE-2010-4152Nov 3, 2010
    4site
    4site CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in catalog/index.shtml in 4site CMS 2.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the i and th vectors are already covered by CVE-2009-0646.

  • CVE-2010-4151Nov 3, 2010
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989,…

  • CVE-2010-4006Nov 3, 2010
    Wsn Links
    Wsn Links
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in search.php in WSN Links 5.0.x before 5.0.81, 5.1.x before 5.1.51, and 6.0.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) namecondition or (2) namesearch parameter.

  • CVE-2010-4144Nov 2, 2010
    Kisisel Radyo Script
    Kisisel Radyo Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL commands via the Id parameter.

  • CVE-2010-4143Nov 2, 2010
    Phpcheckz
    Phpcheckz
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-3608Sep 24, 2010
    WpQuiz
    WpQuiz
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) password (pw) parameters to (a) admin.php or (b) user.php.

  • CVE-2010-3601Sep 24, 2010
    IbPhotohost
    ibPhotohost
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter.

  • CVE-2010-3485Sep 22, 2010
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2010-3484Sep 22, 2010
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593.

  • CVE-2010-3482Sep 22, 2010
    Primitive
    Primitive CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) title and (2) menutitle parameters. NOTE: this can be leveraged with CVE-2010-3483 to conduct attacks without…

  • CVE-2010-3481Sep 22, 2010
    Apphp
    PHP Microcms
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) password variables, possibly related to include/classes/Login.php. NOTE:…