Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,162

Image ID Title
CVE-2016-4337 SQL Injection in Ktools.net Photostore (CVE-2016-4337)
CVE-2016-4893 SQL Injection in SetsucoCMS all (CVE-2016-4893)
CVE-2017-7719 SQL Injection in WordPress Web Dorado (CVE-2017-7719)
CVE-2017-6088 SQL Injection in Eyesofnetwork (CVE-2017-6088)
CVE-2016-4468 SQL Injection in Pivotal Cloud Foundry (CVE-2016-4468)
CVE-2015-6028 SQL Injection in Castle Rock Computing SNMPc (CVE-2015-6028)
CVE-2017-7581 SQL Injection in News module (CVE-2017-7581)
CVE-2017-3886 SQL Injection in Cisco Unified Communications Manager (CVE-2017-3886)
CVE-2017-7410 SQL Injection in WebsiteBaker (CVE-2017-7410)
CVE-2017-7290 SQL Injection in XOOPS (CVE-2017-7290)
CVE-2017-6013 SQL Injection in Subrion CMS (CVE-2017-6013)
CVE-2017-2641 SQL Injection in Moodle (CVE-2017-2641)
CVE-2017-6550 SQL Injection in Kinsey Infor-Lawson (CVE-2017-6550)
CVE-2016-8025 SQL Injection in Intel Security VirusScan Enterprise Linux (VSEL) (CVE-2016-8025)
CVE-2016-8027 SQL Injection in Intel Security McAfee ePolicy Orchestrator (ePO) (CVE-2016-8027)
CVE-2017-3899 SQL Injection in Intel Security Advanced Threat Defense (ATD) Linux (CVE-2017-3899)
CVE-2017-6570 SQL Injection in WordPress Mail Masta Project (CVE-2017-6570)
CVE-2017-6571 SQL Injection in WordPress Mail Masta Project (CVE-2017-6571)
CVE-2017-6572 SQL Injection in WordPress Mail Masta Project (CVE-2017-6572)
CVE-2017-6573 SQL Injection in WordPress Mail Masta Project (CVE-2017-6573)
CVE-2017-6574 SQL Injection in WordPress Mail Masta Project (CVE-2017-6574)
CVE-2017-6575 SQL Injection in WordPress Mail Masta Project (CVE-2017-6575)
CVE-2017-6576 SQL Injection in WordPress Mail Masta Project (CVE-2017-6576)
CVE-2017-6577 SQL Injection in WordPress Mail Masta Project (CVE-2017-6577)
CVE-2017-6578 SQL Injection in WordPress Mail Masta Project (CVE-2017-6578)
CVE-2016-9728 SQL Injection in IBM Qradar (CVE-2016-9728)
CVE-2016-7780 SQL Injection in Exponent CMS (CVE-2016-7780)
CVE-2016-7781 SQL Injection in Exponent CMS (CVE-2016-7781)
CVE-2016-7782 SQL Injection in Exponent CMS (CVE-2016-7782)
CVE-2016-7783 SQL Injection in Exponent CMS (CVE-2016-7783)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details