CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,962 vulnerabilities with CWE-89
CVE-2008-4338
Brilliant Gallery 5.x-6.x - Authenticated SQL Injection via nid/qid/state/user Parameters
CVE-2008-4335
Atomic Photo Album 1.1.0pre4 - SQL Injection via apa_album_ID Parameter
CVE-2008-4332
PHP infoBoard V.7 Plus - SQL Injection via idcat Parameter
CVE-2008-4328
EasyRealtorPRO 2008 - SQL Injection via site_search.php Parameters
CVE-2008-4094
Ruby on Rails < 2.1.1 - SQL Injection via :limit and :offset Parameters
CVE-2008-4241
CJ Ultra Plus 1.0.4 - SQL Injection via SID Cookie
CVE-2008-4205
Attachmax Dolphin - SQL Injection via Category Parameter
CVE-2008-4204
SoftAcid Hotel Reservation System - SQL Injection via city Parameter
CVE-2008-4203
CzarNews < 1.20 - SQL Injection via recook Cookie
CVE-2008-4202
Gonafish LinksCaffePRO 4.5 - SQL Injection via idd Parameter in deadlink Action
CVE-2008-4150
Diesel Joke Site - SQL Injection via picture_category.php id Parameter
CVE-2008-4148
Drupal Mailhandler < 5.x-1.3 - SQL Injection
CVE-2008-4145
Addalink < 1.0 - SQL Injection via category_id Parameter
CVE-2008-4144
ACG-ScriptShop E-Gold Script Shop - SQL Injection via cid Parameter
CVE-2008-4143
RazorCommerce Shopping Cart - SQL Injection via category_search.php id Parameter
CVE-2008-4142
ephpscripts e-php_cms - SQL Injection via article.php es_id Parameter
CVE-2008-4186
webCMS Portal Edition - SQL Injection via id_doc Parameter
CVE-2008-4185
webCMS Portal Edition - SQL Injection via id Parameter in documentos Action
CVE-2008-4178
Downline Goldmine Builder and Addons - SQL Injection via id Parameter
CVE-2008-4177
Pre Real Estate Listings - SQL Injection via Search Parameter
CVE-2008-4176
FoT Video scripti 1.1 beta - SQL Injection via izle.asp oyun Parameter
CVE-2008-4175
Linkbidscript - SQL Injection
CVE-2008-4161
Assetman 2.5b - SQL Injection via search_inv.php order and order_by Parameters
CVE-2008-4173
ProArcadeScript 1.3 - SQL Injection via Random Parameter
CVE-2008-4172
Cars & Vehicle Script - SQL Injection via lnkid Parameter
Details
Vulnerabilities 19,962
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits