CVE-2020-27227

An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the server. An attacker can send a web request with parameters containing specific parameter to trigger this vulnerability, potentially allowin...

CVE-2020-27227

OpenClinic GA 5.173.3 is affected by an unauthenticated command injection. TALOS-2020-1203 documents that specially crafted requests to the server (notably POST to /openclinic/util/shell.jsp with parameters such as c=whoami) can execute commands, potentially exfiltrating the database and credenti...