EUVD-2017-14697

Malware in sbrugna...

Sql injection

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

CVE-2017-5598

This CVE refers to eClinicalWorks healow@work 8.0 build 8, where a blind SQL injection exists in the EmployeePortalServlet. The vulnerability is exploitable by unauthenticated attackers via an HTTP POST to the EmployeePortalServlet page, affecting the employer parameter, and can be used to exfilt...

CVE-2017-5598: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...