CVE-2020-27246

OpenClinic GA 5.173.3 contains CVE-2020-27246: an authenticated SQL injection in the listImmoLabels.jsp page, via the immoComment parameter. The TALOS advisory documents the vulnerability as a flaw in dynamic SQL construction (immoService, immoLocation, immoCode, immoBuyer, immoComment), with cra...