CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,930 vulnerabilities with CWE-89
CVE-2009-1651
2daybiz Business Community Script - SQL Injection via mid Parameter
CVE-2009-1650
Shutter 0.1.1 - SQL Injection via albumID, tagID, or photoID Parameter
CVE-2009-1626
EZ-Blog - SQL Injection via Category Parameter
CVE-2009-1622
EcShop 2.5.0 - SQL Injection via order_sn Parameter
CVE-2009-1613
Leap CMS 0.1.4 - SQL Injection via Searchterm or Email Parameter
CVE-2009-1585
TemaTres 1.031 - SQL Injection via id_correo_electronico or id_password Parameter
CVE-2009-1584
TemaTres 1.0.3 and 1.031 - SQL Injection via Multiple Parameters
CVE-2009-1548
Blusky CMS - SQL Injection via News ID Parameter
CVE-2009-1468
IceWarp eMail Server < 9.3.0 - Authenticated SQL Injection via XML Search Query
CVE-2009-1509
MyioSoft AjaxPortal 3.0 - SQL Injection via Page Parameter
CVE-2009-1508
X-Forum 0.6.2 - SQL Injection via cookie_username Parameter
CVE-2009-1506
eLitius 1.0 - SQL Injection via id Parameter
CVE-2009-1505
Drupal News Page < 5.x-1.2 - Authenticated SQL Injection via Include Words Field
CVE-2009-1503
TigerDMS - SQL Injection via Login Username and Password Parameters
CVE-2009-1500
ProjectCMS 1.0 Beta - SQL Injection via sn Parameter
CVE-2009-1499
Joomla! - SQL Injection via MailTo Component Article Parameter
CVE-2009-1487
FunGamez RC1 - SQL Injection via login_user Parameter
CVE-2009-1481
PuterJam's Blog 3.0.6.170 - SQL Injection via cname Parameter
CVE-2009-1480
Pragyan CMS 2.6.4 - SQL Injection via Fileget Parameter
CVE-2009-1453
Tiny Blogr 1.0.0 rc4 - SQL Injection via txtUsername Parameter
CVE-2009-1433
SilverStripe < 2.3.1 - SQL Injection via File::find Filename Parameter
CVE-2009-1411
Seditio CMS 1.0 - SQL Injection via Events Plugin c Parameter
CVE-2009-1410
Quick.Cms.Lite 0.5 - SQL Injection via id Parameter
CVE-2009-1409
e107 <= 0.7.15 - SQL Injection via usersettings.php Hide Parameter
CVE-2009-1404
PastelCMS 0.8.0 - SQL Injection via Username Parameter
Details
Vulnerabilities 19,930
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits