CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,987 vulnerabilities with CWE-89
CVE-2008-0878
RunCMS MyAnnonces 1.7 - SQL Injection via cid Parameter
CVE-2008-0879
PHP-Nuke Web Links Module - SQL Injection via cid Parameter
CVE-2008-0880
PHP-Nuke EasyContent Module - SQL Injection via page_id Parameter
CVE-2008-0881
PHP-Nuke Okul Module - SQL Injection via okulid Parameter
CVE-2008-0847
XOOPS myTopics - SQL Injection via articleid Parameter
CVE-2008-0849
com_downloads for Joomla and Mambo - SQL Injection via cat Parameter
CVE-2008-0850
Dokeos 1.8.4 - SQL Injection via Multiple Parameters
CVE-2008-0853
com_detail - SQL Injection via id Parameter
CVE-2008-0854
com_salesrep - SQL Injection via rid Parameter
CVE-2008-0855
Joomla and Mambo com_facileforms - SQL Injection via catid Parameter
CVE-2008-0856
e-Vision CMS 2.02 - SQL Injection via id Parameter
CVE-2008-0857
WoltLab Burning Board 3.0.3 PL 1 - SQL Injection via PMList sortOrder Parameter
CVE-2008-0835
Simple CMS <= 1.0.3 - SQL Injection via Area Parameter
CVE-2008-0839
astatsPRO 1.0 - SQL Injection via refer.php id Parameter
CVE-2008-0841
Joomla com_ricette Component - SQL Injection via id Parameter
CVE-2008-0842
Joomla com_clasifier - SQL Injection via cat_id Parameter
CVE-2008-0844
Joomla com_pccookbook - SQL Injection via user_id Parameter
CVE-2008-0845
Dean Logan WP-People Plugin 1.6.1 - SQL Injection via Person Parameter
CVE-2008-0846
Joomla! com_profile - SQL Injection via oid Parameter
CVE-2008-0831
Joomla Rapid Recipe < 1.6.5 - SQL Injection via user_id or category_id Parameter
CVE-2008-0832
Kemas Antonius com_quran < 1.1 - SQL Injection via surano Parameter
CVE-2008-0833
Joomla com_galeria - SQL Injection via id Parameter
CVE-2008-0827
PHP-Nuke Books Module - SQL Injection via cid Parameter
CVE-2008-0829
Joomlapixel Jooget! 2.6.8 - SQL Injection via id Parameter
CVE-2008-0821
OSI Codes Inc. PHP Live! 3.2.2 - SQL Injection via questid Parameter
Details
Vulnerabilities 19,987
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits