EUVD-2017-14697

Malware in sbrugna...

Sql injection

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

CVE-2017-5598

This CVE refers to eClinicalWorks healow@work 8.0 build 8, where a blind SQL injection exists in the EmployeePortalServlet. The vulnerability is exploitable by unauthenticated attackers via an HTTP POST to the EmployeePortalServlet page, affecting the employer parameter, and can be used to exfilt...

CVE-2017-5598: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

PT-2017-16603

Name of the Vulnerable Software and Affected Versions eClinicalWorks healow@work version 8.0 build 8 Description A blind SQL injection issue was discovered, which can be exploited by un-authenticated users via an HTTP POST request to the EmployeePortalServlet page. The employer parameter is...