CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,971 vulnerabilities with CWE-89
CVE-2008-2819
BlognPlus < 2.5.4 - SQL Injection
CVE-2008-2823
PHPeasyblog < 1.13 - SQL Injection via Newsarchive Post Parameter
CVE-2008-2789
basic-cms - SQL Injection via page_id Parameter
CVE-2008-2790
MountainGrafix easyTrade 2.x - SQL Injection via detail.php id Parameter
CVE-2008-2791
Comparison Engine Power Script 1.0 - SQL Injection via id Parameter
CVE-2008-2792
erocms < 1.4 - SQL Injection via Site Parameter
CVE-2008-2793
ClipShare < 3.0 - SQL Injection via group_posts.php tid Parameter
CVE-2008-2796
FreeCMS 0.2 - SQL Injection via Page Parameter
CVE-2008-2774
CartKeeper CKGold Shopping Cart 2.5 and 2.7 - SQL Injection via item.php category_id Parameter
CVE-2008-2775
DT Centrepiece 4.0 - SQL Injection via searchFor Parameter
CVE-2008-2778
Revokebb 1.0 RC11 - SQL Injection via Search Parameter
CVE-2008-2781
DZOIC Handshakes 3.5 - SQL Injection via fname Parameter
CVE-2008-2753
Pooya Site Builder 6.0 - SQL Injection via xslIdn or part Parameter
CVE-2008-2754
eFiction 3.0 and 3.4.3 - SQL Injection via toplists.php list Parameter
CVE-2008-2755
jamm_cms - SQL Injection via id Parameter
CVE-2008-2757
Xigla Absolute News Manager XE 3.2 - Authenticated SQL Injection via search.asp orderby Parameter
CVE-2008-2760
Xigla Absolute Banner Manager XE 2.0 - Authenticated SQL Injection via orderby Parameter
CVE-2008-2762
Xigla Absolute Form Processor XE 4.0 - Authenticated SQL Injection via search.asp orderby Parameter
CVE-2008-2763
Xigla Absolute Live Support XE 5.1 - Authenticated SQL Injection via search.asp orderby Parameter
CVE-2008-2765
Xigla Absolute Image Gallery XE - SQL Injection via categoryid Parameter
CVE-2008-2767
Xigla Absolute Poll Manager XE - Authenticated SQL Injection via search.asp orderby Parameter
CVE-2008-2770
MycroCMS 0.5 - SQL Injection via Entry ID Parameter
CVE-2008-2428
TorrentTrader Classic 1.08 - SQL Injection via Email, Wantusername, or Receiver Parameter
CVE-2008-2746
Gryphon gllcTS2 4.2.4 - SQL Injection via login.php detail Parameter
CVE-2008-2691
JiRo FAQ Manager eXperience 1.0 - SQL Injection via fID Parameter
Details
Vulnerabilities 19,971
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits