Fallos del tipo CWE-89

11.873 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-12938MEDIUMcode-projects Simple Admin Panel updateOrderStatus.php sql injectionEPSS 0.5%CVE-2024-6016MEDIUMitsourcecode Online Laundry Management System admin_class.php sql injectionEPSS 0.5%CVE-2025-5576MEDIUMPHPGurukul Dairy Farm Shop Management System bwdate-report-details.php sql injectionEPSS 0.5%CVE-2022-23972HIGHASUS RT-AX56U - SQL InjectionEPSS 0.5%CVE-2018-25195HIGHWecodex Hotel CMS 1.0 SQL Injection via Admin LoginEPSS 0.5%CVE-2025-8376MEDIUMcode-projects Vehicle Management updatebal.php sql injectionEPSS 0.5%CVE-2018-25183HIGHShipping System CMS 1.0 SQL Injection via admin loginEPSS 0.5%CVE-2023-35072CRITICALSQLi in Coyav Travels ProagentEPSS 0.5%CVE-2023-7081CRITICALSQLi in PosTahsil's Online Payment SystemEPSS 0.5%CVE-2023-49969MEDIUMCustomer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=EPSS 0.5%CVE-2024-2069MEDIUMSourceCodester FAQ Management System delete-faq.php sql injectionEPSS 0.5%CVE-2024-41370CRITICALOrganizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.EPSS 0.5%CVE-2023-35068CRITICALSQLi in BMAs Personnel Tracking SystemEPSS 0.5%CVE-2023-5807CRITICALSQLi in TRtek Software's Education PortalEPSS 0.5%CVE-2024-7871HIGHHuachu Easytest Online Learning Test Platform - SQL InjectionEPSS 0.5%CVE-2024-41372CRITICALOrganizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php.EPSS 0.5%CVE-2023-3616CRITICALSQLi in Mava Softwares Hotel Management SystemEPSS 0.5%CVE-2024-28303CRITICALOpen Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/iEPSS 0.5%CVE-2024-36082MEDIUMSQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an admEPSS 0.5%CVE-2023-35065CRITICALSQLi in Osofts Paint Production ManagementEPSS 0.5%