CVE-2020-27230

A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findSector parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27230

OpenClinic GA 5.173.3 contains multiple authenticated SQL injection vulnerabilities in patientslist.do, notably via the findSector, findDistrict, and related parameters (e.g., findPersonID). TALOS details show the vulnerability arises from string-concatenated SQL construction in getAllPatients, w...