Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,162

Image ID Title
CVE-2022-2315 SQL Injection in Databank (CVE-2022-2315)
CVE-2022-38619 SQL Injection in SmartVista SVFE2 (CVE-2022-38619)
CVE-2022-2177 SQL Injection in Kayrasoft product (CVE-2022-2177)
CVE-2022-38618 SQL Injection in SmartVista SVFE2 (CVE-2022-38618)
CVE-2022-38617 SQL Injection in SmartVista SVFE2 (CVE-2022-38617)
CVE-2022-38616 SQL Injection in SmartVista SVFE2 (CVE-2022-38616)
CVE-2022-38615 SQL Injection in SmartVista SVFE2 (CVE-2022-38615)
CVE-2022-1277 SQL Injection in Inavitas (CVE-2022-1277)
CVE-2022-29709 SQL Injection in CommuniLink Internet Limited CLink Office (CVE-2022-29709)
CVE-2022-31384 SQL Injection in Phpgurukul (CVE-2022-31384)
CVE-2022-31382 SQL Injection in Phpgurukul (CVE-2022-31382)
CVE-2022-31383 SQL Injection in Phpgurukul (CVE-2022-31383)
CVE-2021-41672 SQL Injection in PEEL Shopping CMS (CVE-2021-41672)
CVE-2016-2386 KEV [KEV] SQL Injection in SAP NetWeaver (CVE-2016-2386)
CVE-2022-29704 SQL Injection in BrowsBox CMS (CVE-2022-29704)
CVE-2022-31340 SQL Injection in Simple Inventory System (CVE-2022-31340)
CVE-2022-31339 SQL Injection in Simple Inventory System (CVE-2022-31339)
CVE-2022-30490 SQL Injection in Badminton Center Management System (CVE-2022-30490)
CVE-2022-24240 SQL Injection in ACEweb Online Portal (CVE-2022-24240)
CVE-2021-25874 SQL Injection in AVideo/YouPHPTube AVideo/YouPHPTube (CVE-2021-25874)
CVE-2020-19961 SQL Injection in Zzcms (CVE-2020-19961)
CVE-2021-29004 SQL Injection in Rconfig (CVE-2021-29004)
CVE-2021-39302 SQL Injection in MISP (CVE-2021-39302)
CVE-2021-28993 SQL Injection in Plixer Scrutinizer (CVE-2021-28993)
CVE-2020-23630 SQL Injection in Zzcms (CVE-2020-23630)
CVE-2020-29228 SQL Injection in EGavilanMedia User Registration (CVE-2020-29228)
CVE-2020-35276 SQL Injection in EgavilanMedia ECM Address Book (CVE-2020-35276)
CVE-2020-28860 SQL Injection in OpenAssetDigital Asset Management (CVE-2020-28860)
CVE-2020-25487 SQL Injection in PHPGURUKUL Zoo Management System Using PHP (CVE-2020-25487)
CVE-2020-25514 SQL Injection in Sourcecodester Simple Library Management System (CVE-2020-25514)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details