CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,987 vulnerabilities with CWE-89
CVE-2008-1121
eazyportal < 1.0 - SQL Injection via session_vars Cookie
CVE-2008-1122
Koobi Pro 5.7 - SQL Injection via Downloads Module categ Parameter
CVE-2008-0385
Urulu 2.1 - SQL Injection via connectionId Parameter
CVE-2008-1077
Simpleboard 1.0.3 - SQL Injection via catid Parameter
CVE-2008-1065
XM-Memberstats 2.0e - SQL Injection
CVE-2008-1039
PORAR WEBBOARD - SQL Injection via QID Parameter
CVE-2008-1050
Softbiz Jokes & Funny Pics Script - SQL Injection via sbcat_id Parameter
CVE-2008-1053
Kose_Yazilari module for PHP-Nuke - SQL Injection via artid Parameter
CVE-2008-0942
Aeries Student Information System 3.8.2.8 - SQL Injection via GradebookStuScores.asp GrdBk Parameter
CVE-2008-0943
Aeries Student Information System 3.7.2.2 - SQL Injection via FC Parameter or Term Parameter
CVE-2008-0939
WP Photo Album < 1.1 - SQL Injection via Photo or Album Parameter
CVE-2008-0934
NukeC 2.1 - SQL Injection via id_catg Parameter
CVE-2008-0936
XOOPS Prayer List Module 1.04 - SQL Injection via cid Parameter
CVE-2008-0937
tinyevent 1.01 - SQL Injection via id Parameter
CVE-2008-0911
iScripts MultiCart 2.0 - Authenticated SQL Injection via productid Parameter
CVE-2008-0916
hwdVideoShare 1.1.3 Alpha - SQL Injection via cat_id Parameter
CVE-2008-0918
astatsPRO 1.0.1 - SQL Injection via id Parameter
CVE-2008-0920
OSSIM < 0.9.9 - Authenticated SQL Injection via portname Parameter
CVE-2008-0921
beContent 0.3.1 - SQL Injection via News.php ID Parameter
CVE-2008-0922
PHP-Nuke Manuales 0.1 - SQL Injection via cid Parameter
CVE-2008-0906
PHP-Nuke Docum Module - SQL Injection via artid Parameter
CVE-2008-0907
PHP-Nuke Inhalt Module - SQL Injection via cid Parameter
CVE-2008-0908
Schoolwires Academic Portal - SQL Injection via browse.asp c Parameter
CVE-2008-0873
jlmZone Classifieds - SQL Injection via cid Parameter in Adsview Action
CVE-2008-0874
XOOPS eEmpregos Module - SQL Injection via cid Parameter
Details
Vulnerabilities 19,987
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits