CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,965 vulnerabilities with CWE-89
CVE-2008-3711
PHPArcadeScript 4.0 - SQL Injection
CVE-2008-3713
phpbasket - SQL Injection via pro_id Parameter
CVE-2008-3701
Kayako SupportSuite <3.20.02 - SQL Injection
CVE-2008-3682
YPN PHP Realty - SQL Injection via dpage.php docID Parameter
CVE-2008-3669
ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script - SQL Injection via ItemID Parameter
CVE-2008-3670
Article Friendly Pro - SQL Injection
CVE-2008-3672
PozScripts Classified Ads - SQL Injection
CVE-2008-3673
PozScripts Classified Ads - SQL Injection
CVE-2008-3674
PozScripts TubeGuru - SQL Injection
CVE-2008-3649
Article Friendly Standard - SQL Injection
CVE-2008-3598
psipuss 1.0 - SQL Injection via Cid Parameter or Username Parameter
CVE-2008-3599
OpenImpro 1.1 - SQL Injection via image.php id Parameter
CVE-2008-3601
Quicksilver Forums 1.4.1 - SQL Injection
CVE-2008-3603
Vacation Rental Script 3.0 - SQL Injection
CVE-2008-3604 CRITICAL
ZeeBuddy 2.1 - SQL Injection via bannerclick.php adid Parameter
CVSS 9.8
CVE-2008-3585
PozScripts GreenCart - SQL Injection
CVE-2008-3586
Joomla! com_ezstore - SQL Injection
CVE-2008-3588
phsblog 0.1.1 - SQL Injection via eid, cid, or urltitle Parameter
CVE-2008-3590
E. Z. Poll 2 - SQL Injection via Username and Password Parameters
CVE-2008-3591
Twentyone Degrees Symphony <1.7.01 - SQL Injection
CVE-2008-3594
MagicScripts E-Store Kit - SQL Injection
CVE-2008-3580
Qsoft K-Links - SQL Injection via id Parameter or PATH_INFO
CVE-2008-3582
Keld PHP-MySQL News Script 0.7.1 - SQL Injection
CVE-2008-3561
Powergap Shopsystem - SQL Injection
CVE-2008-3563
Plogger <= 3.0 - SQL Injection via checked Parameter
Details
Vulnerabilities 19,965
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits