CVE-2020-27243

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27245

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27244

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2020-27242

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

Sql injection

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

Sql injection

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

Sql injection

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

Sql injection

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

Sql injection

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27246

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27246

OpenClinic GA 5.173.3 contains CVE-2020-27246: an authenticated SQL injection in the listImmoLabels.jsp page, via the immoComment parameter. The TALOS advisory documents the vulnerability as a flaw in dynamic SQL construction (immoService, immoLocation, immoCode, immoBuyer, immoComment), with cra...

CVE-2020-27245

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27245

OpenClinic GA 5.173.3 is affected by CVE-2020-27245, an authenticated SQL injection in the listImmoLabels.jsp page. The vulnerability involves the immoBuyer parameter and can be triggered by an authenticated HTTP request (examples in TALOS-2020-1208 show the pattern of exploitation for this and r...

CVE-2020-27244

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2020-27244

OpenClinic GA 5.173.3 is affected by SQL injection in the listImmoLabels.jsp page. The vulnerability stems from building SQL with user-controlled inputs (immoLocation, immoService, immoCode, immoBuyer, immoComment) using string concatenation, then preparing and executing that statement. This lead...

CVE-2020-27243

OpenClinic GA 5.173.3 contains authenticated SQL injection flaws in the listImmoLabels.jsp page. The vulnerabilities arise from building SQL with user-supplied parameters (e.g., immoService, immoLocation, immoCode, immoBuyer, immoComment) and then executing via a prepared statement, enabling inje...

CVE-2020-27243

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27242

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27242

OpenClinic GA 5.173.3 contains authenticated SQL injection vulnerabilities in the listImmoLabels.jsp page. The immoLocation parameter (and related parameters such as immoService, immoCode, immoBuyer, and immoComment) are susceptible to SQL injection due to dynamic string concatenation in the SQL ...

OpenClinic GA SQL Injection Vulnerability (CNVD-2021-34999)

OpenClinic GA is an open source hospital integrated information management system . A SQL injection vulnerability exists in manageServiceStocks.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability through a specially crafted HTTP request to conduct a SQL injection atta...