CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,987 vulnerabilities with CWE-89
CVE-2008-0825
Caroline < 1.5 - SQL Injection
CVE-2008-0810
com_scheduling_component - SQL Injection via id Parameter
CVE-2008-0811
AuraCMS 1.62 - SQL Injection via kid or query Parameter
CVE-2008-0815
com_mezun for Joomla! - SQL Injection via id Parameter
CVE-2008-0816
com_sg - SQL Injection via pid Parameter
CVE-2008-0817
com_filebase component for Joomla! and Mambo - SQL Injection via filecatid Parameter
CVE-2008-0795
MGFi XfaQ 1.2 for Joomla and Mambo - SQL Injection via aid Parameter
CVE-2008-0796
Nuboard 0.5 - SQL Injection via threads.php ssid Parameter
CVE-2008-0799
Joomla com_quiz < 0.81 - SQL Injection via tid Parameter
CVE-2008-0800
Joomla com_mcquiz 0.9 Final - SQL Injection via tid Parameter
CVE-2008-0801
PAXXGallery (com_paxxgallery) 0.2 - SQL Injection via iid Parameter
CVE-2008-0802
MediaSlide (com_mediaslide) 0.5 - SQL Injection via albumnum Parameter
CVE-2008-0789
LI-Scripts LI-Countdown - SQL Injection via Years Parameter
CVE-2008-0787
Mybulletinboard - SQL Injection
CVE-2008-0785
Cacti 0.8.6-0.8.7 - Authenticated SQL Injection via Multiple Parameters
CVE-2008-0026
Cisco Unified Communications Manager SQL Injection via Key Parameter
CVE-2008-0770
ibProArcade < 3.3.0 - SQL Injection via g_display_order Cookie Parameter
CVE-2008-0771
Site2Nite real_estate_web - SQL Injection via txtUserName or txtPassword Parameter
CVE-2008-0772
com_doc - SQL Injection via sid Parameter
CVE-2008-0773
Phil Taylor Comments < 0.5.8.5g - SQL Injection via id Parameter
CVE-2008-0776
iTechBids Gold 6.0 - SQL Injection via detail.php item_id Parameter
CVE-2008-0761
Joomla com_pcchess < 0.8 - SQL Injection via user_id Parameter
CVE-2008-0762
Joomla com_iomezun - SQL Injection via id Parameter
CVE-2008-0746
com_gallery - SQL Injection via id Parameter
CVE-2008-0750
Husrev BlackBoard 2.0.2 - SQL Injection via philboard_forum.asp forumid Parameter
Details
Vulnerabilities 19,987
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits