CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,915 vulnerabilities with CWE-89
CVE-2012-1017
BASE 1.4.5 - SQL Injection via ip_addr Parameters
CVE-2012-0983
Scriptsez.net Ez Album - SQL Injection
CVE-2012-0982
Vastal I-Tech Agent Zone - SQL Injection
CVE-2012-0980
phux Download Manager - SQL Injection
CVE-2012-0935
Aryadad CMS - SQL Injection via PageID Parameter
CVE-2012-0913
ICloudCenter ICTimeAttendance 1.0 - SQL Injection
CVE-2012-0069
batavi < 1.2.1 - SQL Injection via ajax.php boxToReload Parameter
CVE-2012-0912
Stoneware webNetwork <6.0.8.0 - SQL Injection
CVE-2012-0906
Moviebase addon <1.5.5 - SQL Injection
CVE-2012-0905
deV!L'z Clanportal Gamebase Addon - SQL Injection via gameid Parameter
CVE-2011-10003 MEDIUM
XpressEngine < 1.4.5 - SQL Injection in Update Query Handler
CVSS 5.5
CVE-2011-10002 MEDIUM
weblabyrinth 0.3.1 - SQL Injection in Labyrinth Function
CVSS 5.5
CVE-2011-10001 MEDIUM
phoenixcf < 2011-02-07 - SQL Injection in articles.cfm
CVSS 5.5
CVE-2011-1151 CRITICAL
Joomla! 1.6.0 - SQL Injection via filter_order and filter_order_Dir Parameters
CVSS 9.1
CVE-2011-4094 CRITICAL
jara 1.6 - SQL Injection
CVSS 9.8
CVE-2011-2715 CRITICAL
Drupal Data 6.x-1.0-alpha14 - SQL Injection via Table or Column Name
CVSS 9.8
CVE-2011-5020 CRITICAL
Online TV Database 2011 - SQL Injection via ID Parameter
CVSS 9.8
CVE-2011-5266 CRITICAL
Imperva SecureSphere Web Application Firewall < 2010-08-12 - SQL Injection Filter Bypass
CVSS 9.8
CVE-2011-1939 CRITICAL
Zend Framework <1.10.9, <1.11.6 - SQL Injection
CVSS 9.8
CVE-2011-1933 CRITICAL
Jifty::DBI < 0.68 - SQL Injection
CVSS 9.8
CVE-2011-3584 CRITICAL
wec_discussion_forum < 2.1.1 - SQL Injection
CVSS 9.8
CVE-2011-3583 CRITICAL
Typo3 4.5.0-4.5.5 - SQL Injection via Prepared Statement Parameter Binding
CVSS 9.8
CVE-2011-2936 CRITICAL
Elgg < 1.7.10 - SQL Injection
CVSS 9.8
CVE-2011-0467 HIGH
SUSE Studio Onsite < 1.0.3-0.18.1 and SUSE Studio Onsite Appliance < 1.1.2-0.25.1 - Authenticated SQL Injection
CVSS 8.8
CVE-2011-5313
Redaxscript 0.3.2 - SQL Injection via Password Reset Parameters
Details
Vulnerabilities 19,915
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits