CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,951 vulnerabilities with CWE-89
CVE-2008-6268
WEBBDOMAIN Multi Languages WebShop Online 1.02 - SQL Injection via detail.php id Parameter
CVE-2008-6266
phpWebSite - SQL Injection via Links.php cid Parameter
CVE-2008-6264
E-topbiz Slide Popups 1.0 - SQL Injection via Admin Password Parameter
CVE-2008-6263
SaturnCMS - SQL Injection via Username Parameter in _userLoggedIn Function
CVE-2008-6262
SaturnCMS - SQL Injection via Translate Function URL Parameter
CVE-2008-6261
E-topbiz AdManager 4 - SQL Injection via View.php Group Parameter
CVE-2008-6260
Ultrastats 0.2.144 and 0.3.11 - SQL Injection via serverid Parameter
CVE-2008-6258
QuadComm Q-Shop 3.0 - SQL Injection via UserID or Pwd Parameter
CVE-2008-6257
Openasp 3.0 - SQL Injection via idpage Parameter
CVE-2008-6256
vBulletin 3.7.3.pl1 - Authenticated SQL Injection via holidayinfo[recurring] Parameter
CVE-2008-6255
vBulletin 3.7.4 - Authenticated SQL Injection via Admin Panel Parameters
CVE-2008-6254
Jadu Galaxies - SQL Injection via categoryID Parameter
CVE-2008-6250
Comdev Web Blogger < 4.1.3 - SQL Injection via arcmonth Parameter
CVE-2008-6249
Galatolo WebManager < 1.3a - SQL Injection via id Parameter
CVE-2008-6247
Scripts For Sites EZ Top Sites - SQL Injection via topsite.php ts Parameter
CVE-2008-6246
Scripts For Sites EZ Webring - SQL Injection via Category Parameter
CVE-2008-6245
Scripts For Sites EZ BIZ PRO - SQL Injection via track.php id Parameter
CVE-2008-6244
Scripts for Sites EZ Gaming Cheats - SQL Injection via view_reviews.php id Parameter
CVE-2008-6243
Scripts For Sites Hotscripts-like Site - SQL Injection via showcategory.php cid Parameter
CVE-2008-6242
Scripts For Sites EZ e-store - SQL Injection via SearchResults.php where Parameter
CVE-2008-6241
FlexPHPSite 0.0.1 and 0.0.7 - SQL Injection via User Check Parameters
CVE-2008-6237
Scripts For Sites Hotscripts-like Site - SQL Injection via software-description.php id Parameter
CVE-2008-6236
Simple Document Management System 1.1.4-1.1.5 - SQL Injection via Login Parameter
CVE-2008-6234
com_musica - SQL Injection via id Parameter
CVE-2008-6233
Five Dollar Scripts Drinks - SQL Injection via recid Parameter
Details
Vulnerabilities 19,951
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits