OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the compnomenclature parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL...

OpenClinic GA Web portal SQL injection vulnerability in 'manageServiceStocks.jsp' page

Summary An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Tested Versions OpenClinic GA 5.173.3...

OpenClinic GA web portal multiple SQL injection vulnerabilities in the 'getAssets.jsp' page

Summary Multiple exploitable SQL injection vulnerabilities exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Tested Versions OpenClinic GA 5.173.3...

OpenClinic GA web portal multiple SQL injection vulnerabilities in 'listImmoLabels.jsp' page

Summary A number of exploitable SQL injection vulnerabilities exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Tested Versions...

CVE-2020-28939

OpenClinic version 0.8.2 is affected by a medical/testnew.php insecure file upload vulnerability. This vulnerability allows authenticated users with substantial privileges to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server...

CVE-2020-28937

OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information PHI stored in the application, via a direct request for the /tests/ URI...

CVE-2020-28938

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users...

CVE-2020-28938

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users...

CVE-2020-28939

OpenClinic version 0.8.2 is affected by a medical/testnew.php insecure file upload vulnerability. This vulnerability allows authenticated users with substantial privileges to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server...

CVE-2020-28937

OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information PHI stored in the application, via a direct request for the /tests/ URI...

Authentication flaw

OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information PHI stored in the application, via a direct request for the /tests/ URI...

Unrestricted file upload

OpenClinic version 0.8.2 is affected by a medical/testnew.php insecure file upload vulnerability. This vulnerability allows authenticated users with substantial privileges to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server...

Cross site scripting

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users...

CVE-2020-28939

CVE-2020-28939 affects OpenClinic 0.8.2; an insecure file upload in medical/test_new.php allows authenticated users with substantial privileges to upload arbitrary files (e.g., PHP web shells), enabling arbitrary code execution on the application server. Publicly described impact aligns with auth...

CVE-2020-28939

OpenClinic version 0.8.2 is affected by a medical/testnew.php insecure file upload vulnerability. This vulnerability allows authenticated users with substantial privileges to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server...

CVE-2020-28938

OpenClinic 0.8.2 is affected by a stored XSS in lib/Check.php (CVE-2020-28938). The issue can let an attacker force actions on behalf of other users via a crafted payload embedded in a patient record. ThreatPost notes the payload could be triggered when an admin user clicks a link, potentially es...

CVE-2020-28938

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users...

CVE-2020-28937

OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information PHI stored in the application, via a direct request for the /tests/ URI...

CVE-2020-28937

CVE-2020-28937 affects OpenClinic 0.8.2. A missing authentication issue allows unauthenticated users to access a patient’s medical test results via direct requests to the /tests/ URI, potentially exposing PHI. The vulnerability is highlighted in multiple sources (NVD entry, ThreatPost report) as ...

OpenClinic GA License Issues Vulnerability

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. An authorization issue vulnerability exists in OpenClinic version 0.8.2, which stems from being affected by a missing authentication...