Connexion Inscription
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Liées 54
slug: cwe-89

Explication

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Exemple
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Liens utiles

🔖 Étiquettes liées

Cwe 20125 Cwe 78120 Cwe 787105 Cwe 41699 Cwe 2296 Cwe 11990 Cwe 9484 Cwe 50270 Cwe 7966 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnérabilités associées 1,707

ID Titre
CVE-2017-17590 FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.
CVE-2017-17591 Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
CVE-2017-17592 Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.
CVE-2017-17594 DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
CVE-2017-17595 Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
CVE-2017-17596 Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
CVE-2017-17597 Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
CVE-2017-17598 Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.
CVE-2017-17599 Injection SQL dans sqli (CVE-2017-17599)
CVE-2017-17600 Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.
CVE-2017-17601 Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.
CVE-2017-17602 Injection SQL dans sqli (CVE-2017-17602)
CVE-2017-17603 Injection SQL dans sqli (CVE-2017-17603)
CVE-2017-17604 Injection SQL dans sqli (CVE-2017-17604)
CVE-2017-17605 Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
CVE-2017-17606 Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17607 CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
CVE-2017-17608 Child Care Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17609 Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
CVE-2017-17610 Injection SQL dans sqli (CVE-2017-17610)
CVE-2017-17611 Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17567 Injection SQL dans sqli (CVE-2017-17567)
CVE-2017-17570 Injection SQL dans sqli (CVE-2017-17570)
CVE-2017-17571 FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
CVE-2017-17572 FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
CVE-2017-17573 Injection SQL dans sqli (CVE-2017-17573)
CVE-2017-17574 FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.
CVE-2017-17575 Injection SQL dans sqli (CVE-2017-17575)
CVE-2017-17576 Injection SQL dans sqli (CVE-2017-17576)
CVE-2017-17577 Injection SQL dans sqli (CVE-2017-17577)

🍪 À propos des cookies

Nous utilisons des cookies pour conserver votre session, mémoriser la langue et améliorer le service.

En savoir plus →