Description

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability.

Related CPE's

a

openclinic_ga_project

openclinic_ga

5.173.3

Vulnerable

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207

ExploitThird Party Advisory

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207

ExploitThird Party Advisory

Weaknesses

[email protected]

Secondary
CWE-89

[email protected]

Primary
CWE-89

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-04-19T19:15:12.943Z

4 years ago

Last modified

2024-11-21T04:20:55.577Z

1 year ago