Command injection

A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands...

CVE-2020-14492 OpenClinic GA

OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s browser...

CVE-2020-14493

CVE-2020-14493 affects OpenClinic GA versions 5.09.02 and 5.89.05b. A low-privilege user can craft SQL that writes arbitrary files on the server, potentially enabling execution of arbitrary commands. The ICS advisory indicates remote exploitation with high risk and public exploits available, and ...

CVE-2020-14493 OpenClinic GA

A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands...

CVE-2020-14490 OpenClinic GA

OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files...

CVE-2020-14490

OpenClinic GA versions 5.09.02 and 5.89.05b contain a path traversal vulnerability (CWE-22) that allows arbitrary local files to be specified via parameters and may execute uploaded files, risking disclosure of sensitive data and code execution. The issue corresponds to CVE-2020-14490; root cause...

CVE-2020-14489

OpenClinic GA versions 5.09.02 and 5.89.05b are affected by CVE-2020-14489 due to storing passwords with inadequate hashing complexity, potentially enabling password recovery via known cracking techniques. Affected component: password storage mechanism. Impact: attacker could recover user passwor...

CVE-2020-14494

OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

CVE-2020-14494

OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts...

Default credentials

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks...

CVE-2020-14491

OpenClinic GA is affected by CVE-2020-14491 due to missing authorization checks before SQL query execution, enabling a low-privilege user to access privileged information. Affected versions: OpenClinic GA 5.09.02 and 5.89.05b. Root cause: improper permission validation before database operations....

CVE-2020-14494

OpenClinic GA is affected (versions 5.09.02 and 5.89.05b) by CVE-2020-14494, an authentication mechanism with insufficient complexity that may allow unauthorized access after a fixed number of attempts. The ICS advisory also notes multiple authentication-related issues and, in practice, indicates...

CVE-2020-14494

OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts...

CVE-2020-14484

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks...

CVE-2020-14484

OpenClinic GA is affected on versions 5.09.02 and 5.89.05b. The issue is an authentication flaw that bypasses account lockout protection, enabling brute-force password attempts. The ICS advisory confirms CVE-2020-14484 and links to multiple related vulnerabilities in the same product family. Impa...

CVE-2020-14485

OpenClinic GA CVE-2020-14485 affects OpenClinic GA versions 5.09.02 and 5.89.05b. The issue is an authentication bypass using an alternate path or channel that may allow a session with limited functionality and execution of admin functions such as SQL queries. ICS advisories indicate this vulnera...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

OpenClinic GA File Upload Vulnerability

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. A file upload vulnerability exists in OpenClinic GA version 5.09.02 and 5.89.05b, which stems from the program faili...