CVE-2020-27234

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27233

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Design/Logic Flaw

An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privilege escalation. An attacker can replace a file to exploit this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27228

OpenClinic GA 5.173.3 is affected by an installation-time privilege-escalation vulnerability (CVE-2020-27228). The underlying issue is an incorrect default permissions setup that permits modification of the OpenClinic MySQL service binary (example path: c:\projects\openclinic\mysql5\bin\mysqld.ex...

CVE-2020-27236

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27235

OpenClinic GA 5.173.3 contains multiple unauthenticated SQL injection vulnerabilities in the getAssets.jsp page (parameters include supplierUID, serviceuid, description, compnomenclature, nomenclature, code, serialnumber, assetStatus, componentStatus, and others). The page constructs SQL queries ...

CVE-2020-27233

CVE-2020-27233 concerns OpenClinic GA 5.173.3, where the supplierUID parameter in getAssets.jsp is vulnerable to SQL injection. The vulnerability is exploitable via an authenticated HTTP request, leading to potential arbitrary SQL execution. The connected sources (e.g., TALOS advisory, Red Hat en...

CVE-2020-27233

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the code parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attac...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. An SQL injection vulnerability exists in the findDistrict parameter of the "Patientslist.do" page in OpenClinic GA...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. An SQL injection vulnerability exists in the immoCode parameter in listImmoLabels.jsp in OpenClinic GA version...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the description parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injectio...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. An SQL injection vulnerability exists in the findSector parameter of the "Patientslist.do" page in OpenClinic GA...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the nomenclature parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injecti...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital integrated information management system . A SQL injection vulnerability exists in quickFile.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability via a specially crafted HTTP request to conduct a SQL injection attack...

OpenClinic GA web portal SQL injection vulnerability in 'statistics/quickFile.jsp' page

Summary An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Tested Versions OpenClinic GA 5.173.3 Product...

OpenClinic GA web portal multiple SQL injection vulnerabilities in 'patientslist.do' page

Summary A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Tested Versions...