VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,295)

page 819 of 1,015
  • CVE-2010-0458Jan 28, 2010
    Netartmedia
    Blog System
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in NetArt Media Blog System 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to index.php and the (2) note parameter to blog.php.

  • CVE-2010-0457Jan 28, 2010
    Magic Portal
    magic-portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in home.php in magic-portal 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0456Jan 28, 2010
    Indianpulse
    Game Server
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the indianpulse Game Server (com_gameserver) component 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the grp parameter in a gameserver action to index.php.

  • CVE-2010-0375Jan 21, 2010
    Jce Tech
    PHP Calendars Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in product_list.php in JCE-Tech PHP Calendars, downloaded 2010-01-11, allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2010-0373Jan 21, 2010
    Joomla
    libros
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the libros (com_libros) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

  • CVE-2010-0372Jan 21, 2010
    Joomla
    Articlemanager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Articlemanager (com_articlemanager) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the artid parameter in a display action to index.php.

  • CVE-2009-4628Jan 18, 2010
    Joomla
    TPDugg
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the TemplatePlaza.com TPDugg (com_tpdugg) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a tags action to index.php.

  • CVE-2009-4625Jan 18, 2010
    Tamlyn Creative
    BF Survey Pro Free
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the updateOnePage function in components/com_bfsurvey_pro/controller.php in BF Survey Pro Free (com_bfsurvey_profree) 1.2.4, and other versions before 1.2.6, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the…

  • CVE-2009-4624Jan 18, 2010
    Nicecoder
    Idesk
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in download.php in Nicecoder iDesk allows remote attackers to execute arbitrary SQL commands via the cat_id parameter, a different vector than CVE-2005-3843.

  • CVE-2009-4621Jan 18, 2010
    Discuz
    JiangHu Inn plugin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JiangHu Inn plugin 1.1 and earlier for Discuz! allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action to forummission.php.

  • CVE-2009-4620Jan 18, 2010
    Joomla
    Joomloc
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joomloc (com_joomloc) component 1.0 for Joomla allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task to index.php.

  • CVE-2009-4618Jan 18, 2010
    Tourismscripts
    Bus Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Tourism Script Bus Script allow remote attackers to execute arbitrary SQL commands via the sitetext_id parameter to (1) aboutus.php and (2) faq.php.

  • CVE-2009-4617Jan 18, 2010
    Tourismscripts
    Tourism Script Accomodation Hotel Booking Portal Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Tourism Script Accommodation Hotel Booking Portal Script allow remote attackers to execute arbitrary SQL commands via the hotel_id parameter to (1) hotel.php, (2) details.php, (3) roomtypes.php, (4) photos.php, (5) map.php, (6)…

  • CVE-2009-4615Jan 18, 2010
    Myrephp
    Holiday Rental Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in review.php in MYRE Holiday Rental Manager allows remote attackers to execute arbitrary SQL commands via the link_id parameter in a show_review action.

  • CVE-2009-4613Jan 14, 2010
    Netartmedia
    Real Estate Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2009-4600Jan 12, 2010
    Netartmedia
    Real Estate Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the Email parameter (aka the username field). NOTE: some of these details are obtained from third party information.

  • CVE-2009-4599Jan 12, 2010
    Joomla
    Js Jobs
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the JS Jobs (com_jsjobs) component 1.0.5.6 for Joomla! allow remote attackers to execute arbitrary SQL commands via (1) the md parameter in an employer view_company action to index.php or (2) the oi parameter in an employer view_job…

  • CVE-2009-4598Jan 12, 2010
    Joomla
    JPhoto
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JPhoto (com_jphoto) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a category action to index.php.

  • CVE-2009-4597Jan 12, 2010
    Phpwares
    PHP Inventory
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a users details action, and allow remote attackers to execute arbitrary SQL commands via the (2) user…

  • CVE-2009-4595Jan 12, 2010
    Phpwares
    PHP Inventory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in PHP Inventory 1.2 allows remote authenticated users to execute arbitrary SQL commands via the sup_id parameter in a suppliers details action. NOTE: the provenance of this information is unknown; the details are obtained solely from…