VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,295)

page 846 of 1,015
  • CVE-2009-0832Mar 5, 2009
    PHP-Fusion
    E-Cart module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter.

  • CVE-2009-0831Mar 5, 2009
    PHP-Fusion
    Members Cv Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the sortby parameter.

  • CVE-2009-0829Mar 5, 2009
    QuoteBook
    QuoteBook
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1) MyBox and (2) selectFavorites parameters to (a) quotes.php and the (3) QuoteName and (4) QuoteText parameters to (b) quotesadd.php. NOTE: the provenance of…

  • CVE-2009-0810Mar 4, 2009
    Xguestbook
    Xguestbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter.

  • CVE-2008-6394Mar 4, 2009
    Office Ocx
    Cs Cart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cs_cookies[customer_user_id] cookie parameter.

  • CVE-2009-0750Mar 2, 2009
    Txtsql
    smNews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2008-6392Mar 2, 2009
    1scripts
    Z1exchange
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showads.php in Z1Exchange allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-6391Mar 2, 2009
    Jbook
    Jbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the username (user parameter).

  • CVE-2008-6390Mar 2, 2009
    Ocean12
    Membership Manager Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-6389Mar 2, 2009
    Rae Media
    Contact Management Software
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in asadmin/default.asp in Rae Media Contact Management Software SOHO, Standard, and Enterprise allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6381Mar 2, 2009
    Bcoos
    Bcoos
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authenticated users with Addresses module permissions to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-6380Mar 2, 2009
    Active Web
    Helpdesk
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.

  • CVE-2008-6379Mar 2, 2009
    Mxmania
    Gallery Mx
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pics_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2008-6378Mar 2, 2009
    Calendar Mx
    Calendar Mx Professional
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in calendar_Eventupdate.asp in Calendar Mx Professional 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2008-6376Mar 2, 2009
    Jbook
    Jbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the password (pass parameter).

  • CVE-2008-6372Mar 2, 2009
    Ocean12
    FAQ Manager Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a Cat action. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6371Mar 2, 2009
    Ocean12
    Membership Manager Pro
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username (Username parameter).

  • CVE-2008-6369Mar 2, 2009
    Ocean12
    Contact Manager Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to execute arbitrary SQL commands via the Sort parameter.

  • CVE-2008-6366Mar 2, 2009
    Adserversolutions
    Affiliate Software Java
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, possibly related to the uname and pass parameters to logon_process.jsp. NOTE: some of…

  • CVE-2008-6365Mar 2, 2009
    Adserversolutions
    AD Management Software
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, related to the uname or pass parameters to logon.jsp or logon_processing.jsp. NOTE: some…