CVE-2017-5598: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

PT-2017-16603

Name of the Vulnerable Software and Affected Versions eClinicalWorks healow@work version 8.0 build 8 Description A blind SQL injection issue was discovered, which can be exploited by un-authenticated users via an HTTP POST request to the EmployeePortalServlet page. The employer parameter is...