CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,952 vulnerabilities with CWE-89
CVE-2008-5785
V3 Chat - Profiles/Dating Script 3.0.2 - SQL Injection
CVE-2008-5782
ZeeMatri 3.0 - SQL Injection via bannerclick.php adid Parameter
CVE-2008-5781
Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 - SQL Injection
CVE-2008-5779
Free Links Directory Script <1.2a - SQL Injection
CVE-2008-5778
Free Links Directory Script 1.2a - SQL Injection
CVE-2008-5777
CadeNix - SQL Injection via cid Parameter
CVE-2008-5775
Aperto Blog 0.1.1 - SQL Injection
CVE-2008-5774
ASPSiteWare HomeBuilder <2.0 - SQL Injection
CVE-2008-5772
ASPSiteWare RealtyListings <2.0 - SQL Injection
CVE-2008-5768
XOOPS 0.22 - Print Module - SQL Injection
CVE-2008-5767
gNews Publisher - SQL Injection via authorID Parameter
CVE-2008-5766
Farsi Script Faupload - SQL Injection
CVE-2008-5751
AlstraSoft Web Email Script Enterprise - SQL Injection
CVE-2008-5739
Pligg CMS 9.9.5 Beta - SQL Injection
CVE-2008-5737
Nodstrum MySQL Calendar <1.2 - SQL Injection
CVE-2008-5733
Team Impact TI Blog System - SQL Injection
CVE-2008-5727
AIST NetCat < 3.12 - SQL Injection via Password Recovery Query String
CVE-2008-5726
stormBoards 1.0.1 - SQL Injection via Thread ID Parameter
CVE-2008-5707
Iltaweb Alisveris Sistemi - SQL Injection
CVE-2008-4303
php-collab < 2.5 - SQL Injection via Login Form Parameter
CVE-2008-2380
Courier-Authlib - SQL Injection via Apostrophe in Query Parameters
CVE-2008-1094
Barracuda Spam Firewall <3.5.12.007 - SQL Injection
CVE-2008-5665
XOOPS xhresim module - SQL Injection via index.php no Parameter
CVE-2008-5655
MyioSoft EasyBookMarker 4.0 - SQL Injection
CVE-2008-5654
MyioSoft EasyCalendar 4.0 - SQL Injection
Details
Vulnerabilities 19,952
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits