用户工具

站点工具


cwe:cn:definition:89

差别

这里会显示出您选择的修订版和当前版本之间的差别。

到此差别页面的链接

行 37: <{{ss=" 03;89||Acce}}>< - 1 < - 1 <{{ss=" 03;89|<:
cwe:cn:definition:89 [2013/06/03 13:17]
evan [Enabling Factors for Exploitation]
cwe:cn:definition:89 [2014/09/04 15:00] (当前版本)
行 1: 行 1:
 ====== CWE-89:​SQL命令中使用的特殊元素转义处理不恰当(SQL注入) ====== ====== CWE-89:​SQL命令中使用的特殊元素转义处理不恰当(SQL注入) ======
 ^ID|89| ^ID|89|
-^类型|弱点|+^Type|Weakness|
 ^Abstraction|Base| ^Abstraction|Base|
-^状态|草稿|+^Status|Draft|
 ^MITRE|http://​cwe.mitre.org/​data/​definitions/​89.html| ^MITRE|http://​cwe.mitre.org/​data/​definitions/​89.html|
-^英文|http://​wiki.scap.org.cn/​cwe/​en/​definition/​89| +^English|http://​wiki.scap.org.cn/​cwe/​en/​definition/​89| 
-^中文|http://​wiki.scap.org.cn/​cwe/​cn/​definition/​89|+^Chinese|http://​wiki.scap.org.cn/​cwe/​cn/​definition/​89|
  
-===== 概要描述 ​=====+===== Description Summary ​===== 
 +The software constructs all or part of an SQL command using 
 +externally-influenced input from an upstream component, but it does not 
 +neutralize or incorrectly neutralizes special elements that could modify the 
 +intended SQL command when it is sent to a downstream 
 +component.
  
-软件使用来自一个上游组件的外部输入数据构造全部或部分的SQL命令,但它在将SQL命令发送到下游组件时,没有处理或没有正确地处理输入数据中可能会改变预期的SQL的特殊元素。 +===== Extended Description ​===== 
-===== 扩展描述 ​=====+Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. This can be used to alter query logic to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. ​
  
-在没有充分地去除或引述用户可控的输入中的SQL语法的情况下,生成的SQL查询可能导致这些用户输入被解释为SQL语句而并非普通的用户数据。这能够被用于改变查询逻辑以绕过安全检查或者插入额外的语句修改后台数据库,甚至包括执行系统命令。+SQL injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes. ​
  
-SQL注入已经成为数据驱动网站的一个普遍问题。这种缺陷容易被发现,容易被利用,正因如此,任何网站或软件包——哪怕只有很小的用户群体都有可能成为这种类型攻击的主体。这种缺陷依赖于一个事实,即SQL没有将控制层和数据层真正地区别开。 
-===== 引入方式 ===== 
  
-这种弱点通常出现在使用数据库保存用户输入的富数据(data-rick)应用程序中。 
-===== 利用要点 ===== 
  
-应用程序动态地生成包含用户输入的查询。+===== Modes of Introduction ===== 
 +This weakness typically appears in data-rich applications that save user 
 +inputs in a database.
  
  
-===== Likelihood of Exploit ===== 
-利用可能性 
  
-Very High+===== Enabling Factors for Exploitation ===== 
 +The application dynamically generates queries that contain user input. ​
  
-非常高+ 
 + 
 +===== Likelihood of Exploit ===== 
 +Very High
  
 ===== Common Consequences ===== ===== Common Consequences =====
行 37: 行 42:
 |Access_Control|Bypass protection mechanism|If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability. | |Access_Control|Bypass protection mechanism|If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability. |
 |Integrity|Modify application data|Just as it may be possible to read sensitive information,​ it is also possible to make changes or even delete this information with a SQL injection attack. | |Integrity|Modify application data|Just as it may be possible to read sensitive information,​ it is also possible to make changes or even delete this information with a SQL injection attack. |
- 
-===== 常见的影响 ===== 
-^范围 ^技术影响 ^ 备注 ^ 
-|机密性|读取应用程序数据|因为SQL数据库e to cilinv ^ 令下游组设计失误圂 ===== Common Consequences =====
===== Common Consequences =====
行 42:
 |Access_Control|Bypass protection mechanism{{ss=" 03;89| |Acce}}>===== Common Consequences =====
 
 ===== C见的影响 =====&Po g>Without sufficient removal or quoting of SQtr> +Very High
c Analys |<- Bquery / Byionode "> +Very High
qugassion is ionhniquQL on,#160;+Very High
 +Very High
+Very High
+Very High
qugassion is ionhniquQL on,#160;+Very High
 +Very High
+Very High
qugassion is ionhniquQL on,#160;+Very High
 +Very High
c Analys |<- Source Code "> +Very High
qugassion is ionhniquQL on,#160;+Very High
 +Very High
c Analys |<- Source Code "> +Very High
qugassion is ionhniquQL on,#160;+Very High
 +Very High
 +Very High
qugassion is ionhniquQL on,#160;+Very High
+
===== Common Consequences =====
|Access_Control|Bypass protection mechanism{{ss=" 03;89| <:|Acce}}>===== Common Consequences =====
|Acce}}>>
差 up"> docInfoa> (14/09/04 15:00]evan < 由 tors fp"> up"> "wrapper gro -->
PAGE ACTION p"> ss="户工具
    v近更改
  • 修订 [Vpng"ifftyps">修订记="claim">o近更改
  • k">反向链 [Opng"ifftyk">反向链="claim">
  • nofollow" title= ">n图 [X]">t n管理器
    ank">[SCAP中文社 89.htdo href="/li> th="48" height="48" alt="" /> nk1" -do hre.gifAP WIKI ank">[SCAP中文社php.neoption> th="48" height="48" alt="" /> nk1" -php.gifAP WIKI ank">[SCAP中validts" .w389.htthat /">[ernrption> th="48" height="48" alt="" /> nk1" -der"5n>SCAP WIKI ank">[SCAP中jigsaw.w389.httss-validts" tthat /">[ernr?profi> th="48" height="48" alt="" /> nk1" - ank">[SCAP中 89.htf="/li> th="48" height="48" alt="" /> nk1" -dwriSCAP WIKI on="/staup"> "wrapper grofoo ="pad groupcss.p====splay:norong*/var NS='cwe:cn:definition';var name_bdhmProtohea = ((CAPs:" Pi" a"pad gvar NS='cwe:cn:definition';var name_paq = _paq || []; _paq.push(['f-likP" /Vl-s']); _paq.push(['etroneLoupT-likqug']); e(/\bno-js) { nameu=((CAPs:" [er=true; g.async=true; g.th="u+'pi" ajs'; criamp;nNode.e backBefore(g,s); })(); arset="utf-noset="utitio width="4AP中文社区首页] seteen__DER "value="cwe:cnlss="iff d
    | id="d)dokuwrapperv id="dokuw