72 matches found
Sql injection
RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file...
Design/Logic Flaw
RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input...
Sql injection
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php...
CVE-2023-33480
RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input...
CVE-2023-33478
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php...
CVE-2023-33479
CVE-2023-33479 affects RemoteClinic version 2.0 and is a SQL injection vulnerability in the /staff/edit.php file. The vulnerability’s impact is described as high/critical across sources, with CVSS v3.1 scores of 9.8 (CRITICAL), indicating potential confidentiality, integrity, and availability imp...
CVE-2023-33480
CVE-2023-33480 affects RemoteClinic 2.0. The issue stems from lack of input validation and access control in staff/register.php and edit-my-profile.php, enabling remote attackers with low-privileged credentials to create admin users, escalate privileges, upload PHP code, and execute commands via ...
CVE-2023-33479
RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file...
CVE-2023-33481
RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php...
CVE-2023-33480
RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input...
CVE-2023-33478
RemoteClinic 2.0 is affected by a SQL injection in the ID parameter of /medicines/stocks.php. The vulnerability is documented across multiple sources (NVD/Red Hat/CVE entries) with CVSS v3.1 base score 9.8 (CRITICAL) and an attack vector of NETWORK, requiring no privileges or user interaction. Th...
Saad Irfan RemoteClinic Security Vulnerability
Saad Irfan RemoteClinic is a Saad Irfan open source application. Provides the ability to remotely manage your clinic via the web. A security vulnerability exists in RemoteClinic version 2.0, which stems from a lack of input validation and access control in the staff/register.php endpoint and the...
PT-2023-24357 · Unknown · Remote Clinic
Name of the Vulnerable Software and Affected Versions: RemoteClinic version 2.0 Description: The issue concerns a time-based blind SQL injection attack. This attack occurs in the start GET parameter of the "patients/index.php" API endpoint. The estimated number of potentially affected devices...
CVE-2023-33478
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php...
CVE-2023-33481
RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection in the 'start' parameter of patients/index.php. The issue stems from improper handling of user input in that endpoint, enabling an attacker to infer data via time-based responses. Impact is described as high/confidentiality, integ...
Saad Irfan RemoteClinic Security Vulnerability
Saad Irfan RemoteClinic is a Saad Irfan open source application. Provides the ability to remotely manage your clinic via the Web. A security vulnerability exists in Saad Irfan RemoteClinic version 2.0, which stems from a SQL injection vulnerability in the parameter start of the file...
Saad Irfan RemoteClinic Security Vulnerability
Saad Irfan RemoteClinic is a Saad Irfan open source application. Provides the ability to remotely manage your clinic via the Web. A security vulnerability exists in RemoteClinic version 2.0, which stems from a SQL injection vulnerability in the file /staff/edit.php...
CVE-2023-33481
RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php...
