CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,954 vulnerabilities with CWE-89
CVE-2008-4900
YourFreeWorld Classifieds Blaster Script - SQL Injection via tr.php id Parameter
CVE-2008-4897
Logz podcast CMS 1.3.1 - SQL Injection via art Parameter
CVE-2008-4895
YourFreeWorld Downline Builder - SQL Injection via tr.php id Parameter
CVE-2008-4912
RS MAXSOFT fotogalerie - SQL Injection via popup_img.php fotoID Parameter
CVE-2008-4890
1st News 4 Professional - SQL Injection via products.php id Parameter
CVE-2008-4889
deV!L'z Clanportal <= 1.4.9.6 - SQL Injection via Users Parameter in Addbuddy Operation
CVE-2008-4887
NetRisk < 2.0 - SQL Injection via id Parameter
CVE-2008-4886
YourFreeWorld Shopping Cart Script - SQL Injection via index.php c Parameter
CVE-2008-4885
YourFreeWorld Scrolling Text Ads Script - SQL Injection via id Parameter
CVE-2008-4884
YourFreeWorld Classifieds Hosting Script - SQL Injection via tr.php id Parameter
CVE-2008-4883
YourFreeWorld Blog Blaster Script - SQL Injection via tr.php id Parameter
CVE-2008-4882
YourFreeWorld Autoresponder Hosting Script - SQL Injection via tr.php id Parameter
CVE-2008-4881
YourFreeWorld Reminder Service Script - SQL Injection via id Parameter
CVE-2008-4880
Maran PHP Shop - SQL Injection via prodshow.php id Parameter
CVE-2008-4879
Maran PHP Shop - SQL Injection via prod.php cat Parameter
CVE-2008-3867
Interact 2.4.1 - SQL Injection via email_user_key Parameter
CVE-2008-4877
WebCards < 1.3 - SQL Injection via User Parameter
CVE-2008-4806
IBM Lotus Connections < 2.0 - SQL Injection via sortField Parameter
CVE-2008-4804
Gallery module 1.3 for PHP-Nuke - SQL Injection via aid Parameter
CVE-2008-4786
e107 easyshop_plugin - SQL Injection via category_id Parameter
CVE-2008-4785
e107 alternate_profiles_plugin - SQL Injection via newuser.php id Parameter
CVE-2008-4782
Aiocp - SQL Injection
CVE-2008-4778
Koobi CMS 4.3.0 - SQL Injection via Gallery Module galid Parameter
CVE-2008-4777
Joomlearn LMS (com_lms) - SQL Injection via cat Parameter
CVE-2008-4772
QuestCMS - SQL Injection via obj Parameter
Details
Vulnerabilities 19,954
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits