Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,162

Image ID Title
CVE-2017-17823 SQL Injection in Piwigo (CVE-2017-17823)
CVE-2017-17824 SQL Injection in Piwigo (CVE-2017-17824)
CVE-2012-2576 SQL Injection in SolarWinds Storage Manager (CVE-2012-2576)
CVE-2017-16733 SQL Injection in Ecava (CVE-2017-16733)
CVE-2017-16735 SQL Injection in Ecava (CVE-2017-16735)
CVE-2017-1757 SQL Injection in IBM Security Guardium (CVE-2017-1757)
CVE-2017-17779 SQL Injection in Paid To Read Script (CVE-2017-17779)
CVE-2017-15875 SQL Injection in GPWeb (CVE-2017-15875)
CVE-2017-17721 SQL Injection in Zuuse (CVE-2017-17721)
CVE-2017-17643 SQL Injection in FS Lynda Clone (CVE-2017-17643)
CVE-2017-17645 SQL Injection in Bus Booking Script (CVE-2017-17645)
CVE-2017-17651 SQL Injection in Paid To Read Script (CVE-2017-17651)
CVE-2017-17730 SQL Injection in DedeCMS (CVE-2017-17730)
CVE-2017-17731 SQL Injection in DedeCMS (CVE-2017-17731)
CVE-2017-17713 SQL Injection in Trape (CVE-2017-17713)
CVE-2017-17695 SQL Injection in Techno - Portfolio Management Panel (CVE-2017-17695)
CVE-2017-5663 SQL Injection in Apache (CVE-2017-5663)
CVE-2017-17648 SQL Injection in Entrepreneur Dating Script (CVE-2017-17648)
CVE-2017-17638 SQL Injection in Groupon Clone Script (CVE-2017-17638)
CVE-2017-17639 SQL Injection in Muslim Matrimonial Script (CVE-2017-17639)
CVE-2017-17640 SQL Injection in Advanced World Database (CVE-2017-17640)
CVE-2017-17641 SQL Injection in Resume Clone Script (CVE-2017-17641)
CVE-2017-17642 SQL Injection in Basic Job Site Script (CVE-2017-17642)
CVE-2017-17612 SQL Injection in Hot Scripts Clone (CVE-2017-17612)
CVE-2017-17613 SQL Injection in Freelance Website Script (CVE-2017-17613)
CVE-2017-17614 SQL Injection in Food Order Script (CVE-2017-17614)
CVE-2017-17615 SQL Injection in Facebook Clone Script (CVE-2017-17615)
CVE-2017-17616 SQL Injection in Event Search Script (CVE-2017-17616)
CVE-2017-17617 SQL Injection in Foodspotting Clone Script (CVE-2017-17617)
CVE-2017-17618 SQL Injection in Kickstarter Clone Script (CVE-2017-17618)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details