CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,915 vulnerabilities with CWE-89
CVE-2009-3498
hbcms 1.7 - SQL Injection via article_id Parameter
CVE-2009-3497
Vastal I-Tech Agent Zone - SQL Injection via view_listing.php id Parameter
CVE-2009-3495
Vastal I-Tech DVD Zone - SQL Injection via view_mag.php mag_id Parameter
CVE-2009-3494
T-HTB Manager 0.5 - SQL Injection via id or name Parameter
CVE-2009-3491
Kinfusion SportFusion 0.2.2-0.2.3 - SQL Injection via cid[0] Parameter
CVE-2009-3480
iCRM Basic 1.4.2.31 - SQL Injection via p3 Parameter
CVE-2009-3446
com_mytube 1.0 Beta - SQL Injection via user_id Parameter
CVE-2009-3443
Fastball (com_fastball) 1.1.0-1.2 - SQL Injection via League Parameter
CVE-2009-3439
OSSIM < 2.1.2 - Authenticated SQL Injection via Multiple Parameters
CVE-2009-3438
JoomlaFacebook (com_facebook) - SQL Injection via id Parameter
CVE-2009-3436
MaxWebPortal - SQL Injection via FORUM_ID or CAT_ID Parameter
CVE-2009-3434
com_tupinambis 1.0 - SQL Injection via Proyecto Parameter
CVE-2009-3430
Allomani Mobile 2.5 - SQL Injection via Login Username Parameter
CVE-2009-3419
Miniweb Publisher Module 2.0 - SQL Injection via Historymonth Parameter
CVE-2009-3418
Plume CMS 1.2.3 - Authenticated SQL Injection via Manager Parameters
CVE-2009-3417
IDoBlog 1.1 build 30 - SQL Injection via Userid Parameter
CVE-2009-3361
PHP-IPNMonitor - SQL Injection via maincat_id Parameter
CVE-2009-3358
Tourism Scripts Adult Portal Escort Listing - SQL Injection via profile.php user_id Parameter
CVE-2009-3357
com_hbssearch - SQL Injection via h_id, id, or rid Parameters
CVE-2009-3356
Image voting 1.0 - SQL Injection via Show Parameter
CVE-2009-3349
Datavore Gyro 5.0 - SQL Injection via cid Parameter in Home Component
CVE-2009-3343
HotWeb Rentals - SQL Injection via PropId Parameter
CVE-2009-3342
AlphaUserPoints 1.5.2 - SQL Injection via Username2Points Parameter
CVE-2009-3337
serendipity_event_freetag < 3.09 - SQL Injection via Meta Keywords Parameter
CVE-2009-3336
PHP Pro Bid - SQL Injection via auction_id Parameter
Details
Vulnerabilities 19,915
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits