Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,159

Image ID Title
CVE-2016-4905 SQL Injection in WP-OliveCart (CVE-2016-4905)
CVE-2017-6195 SQL Injection in Ipswitch (CVE-2017-6195)
CVE-2017-8917 SQL Injection in Joomla (CVE-2017-8917)
CVE-2017-7952 SQL Injection in INFOR EAM (CVE-2017-7952)
CVE-2017-7886 SQL Injection in Dolibarr ERP/CRM (CVE-2017-7886)
CVE-2017-5527 SQL Injection in TIBCO Spotfire Server (CVE-2017-5527)
CVE-2017-8789 SQL Injection in Accellion File Transfer Appliance (CVE-2017-8789)
CVE-2017-8796 SQL Injection in Accellion File Transfer Appliance (CVE-2017-8796)
CVE-2017-6557 SQL Injection in ArrayOS (CVE-2017-6557)
CVE-2017-8377 SQL Injection in GeniXCMS (CVE-2017-8377)
CVE-2017-2120 SQL Injection in WBCE CMS (CVE-2017-2120)
CVE-2017-7221 SQL Injection in OpenText Documentum Content Server (CVE-2017-7221)
CVE-2017-3549 SQL Injection in Oracle Scripting (CVE-2017-3549)
CVE-2015-7568 SQL Injection in Yeager CMS (CVE-2015-7568)
CVE-2015-7569 SQL Injection in Yeager CMS (CVE-2015-7569)
CVE-2017-7991 SQL Injection in Exponent CMS (CVE-2017-7991)
CVE-2016-1218 SQL Injection in Cybozu Garoon (CVE-2016-1218)
CVE-2017-7717 SQL Injection in SAP NetWeaver AS Java (CVE-2017-7717)
CVE-2017-7878 SQL Injection in Flatcore (CVE-2017-7878)
CVE-2017-7879 SQL Injection in Flatcore (CVE-2017-7879)
CVE-2015-8356 SQL Injection in Bitrix Project (CVE-2015-8356)
CVE-2016-6818 SQL Injection in SAP Business Intelligence platform (CVE-2016-6818)
CVE-2016-2566 SQL Injection in Samsung Galaxy S6 Firmware (CVE-2016-2566)
CVE-2016-1914 SQL Injection in BlackBerry Enterprise Server 12 (BES12) Self-Service (CVE-2016-1914)
CVE-2016-2555 SQL Injection in ATutor (CVE-2016-2555)
CVE-2017-7628 SQL Injection in Smart Related Articles Project (CVE-2017-7628)
CVE-2015-7564 SQL Injection in TeamPass (CVE-2015-7564)
CVE-2016-4337 SQL Injection in Ktools.net Photostore (CVE-2016-4337)
CVE-2016-4893 SQL Injection in SetsucoCMS all (CVE-2016-4893)
CVE-2017-7719 SQL Injection in WordPress Web Dorado (CVE-2017-7719)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details