Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,159

Image ID Title
CVE-2017-17622 SQL Injection in Online Exam Test Application Script (CVE-2017-17622)
CVE-2017-17623 SQL Injection in Opensource Classified Ads Script (CVE-2017-17623)
CVE-2017-17624 SQL Injection in PHP Multivendor Ecommerce (CVE-2017-17624)
CVE-2017-17625 SQL Injection in Professional Service Script (CVE-2017-17625)
CVE-2017-17626 SQL Injection in Readymade PHP Classified Script (CVE-2017-17626)
CVE-2017-17627 SQL Injection in Readymade Video Sharing Script (CVE-2017-17627)
CVE-2017-17628 SQL Injection in Responsive Realestate Script (CVE-2017-17628)
CVE-2017-17629 SQL Injection in Secure E-commerce Script (CVE-2017-17629)
CVE-2017-17630 SQL Injection in Yoga Class Script (CVE-2017-17630)
CVE-2017-17631 SQL Injection in Multireligion Responsive Matrimonial (CVE-2017-17631)
CVE-2017-17632 SQL Injection in Responsive Events And Movie Ticket Booking Script (CVE-2017-17632)
CVE-2017-17633 SQL Injection in Multiplex Movie Theater Booking Script (CVE-2017-17633)
CVE-2017-17634 SQL Injection in Single Theater Booking Script (CVE-2017-17634)
CVE-2017-17635 SQL Injection in MLM Forex Market Plan Script (CVE-2017-17635)
CVE-2017-17636 SQL Injection in MLM Forced Matrix (CVE-2017-17636)
CVE-2017-17637 SQL Injection in Car Rental Script (CVE-2017-17637)
CVE-2017-17586 SQL Injection in FS Olx Clone (CVE-2017-17586)
CVE-2017-17587 SQL Injection in FS Indiamart Clone (CVE-2017-17587)
CVE-2017-17588 SQL Injection in FS IMDB Clone (CVE-2017-17588)
CVE-2017-17589 SQL Injection in FS Thumbtack Clone (CVE-2017-17589)
CVE-2017-17590 SQL Injection in FS Stackoverflow Clone (CVE-2017-17590)
CVE-2017-17591 SQL Injection in Realestate Crowdfunding Script (CVE-2017-17591)
CVE-2017-17592 SQL Injection in Website Auction Marketplace (CVE-2017-17592)
CVE-2017-17594 SQL Injection in DomainSale PHP Script (CVE-2017-17594)
CVE-2017-17595 SQL Injection in Beauty Parlour Booking Script (CVE-2017-17595)
CVE-2017-17596 SQL Injection in Entrepreneur Job Portal Script (CVE-2017-17596)
CVE-2017-17597 SQL Injection in Nearbuy Clone Script (CVE-2017-17597)
CVE-2017-17598 SQL Injection in Affiliate MLM Script (CVE-2017-17598)
CVE-2017-17599 SQL Injection in Advance Online Learning Management Script (CVE-2017-17599)
CVE-2017-17600 SQL Injection in Basic B2B Script (CVE-2017-17600)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details