CVE-2020-27229

CVE-2020-27229 concerns OpenClinic GA 5.173.3, where multiple authenticated SQL injection vulnerabilities exist in the web page patientslist.do . The root cause is improper handling of user input in the findPersonID, findSector, and findDistrict parameters, leading to crafted HTTP requests that c...

PT-2021-11327

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: The issue concerns an exploitable SQL injection vulnerability in the 'patientslist.do' page of the application. Specifically, the findDistrict parameter in the 'patientslist.do' page is vulnerable to...

PT-2021-11325

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: A SQL injection issue exists in the 'patientslist.do' page of the application. The findPersonID parameter in the 'patientslist.do' page is vulnerable to authenticated SQL injection. An attacker can...

PT-2021-11326

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: A SQL injection issue exists in the 'patientslist.do' page of the application. The findSector parameter in this page is vulnerable to authenticated SQL injection. An attacker can trigger this issue b...

PT-2021-11328

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: The issue is related to a SQL injection vulnerability in the 'manageServiceStocks.jsp' page. It can be triggered by a specially crafted HTTP request, allowing an attacker to perform SQL injection aft...

PT-2021-11322

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: An exploitable SQL injection issue exists in the 'quickFile.jsp' page. A specially crafted HTTP request can lead to SQL injection, allowing an attacker to trigger this issue with an authenticated HTT...

OpenClinic GA Elevation of Privilege Vulnerability

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. An elevation of privilege vulnerability exists in OpenClinic GA version 5.173.3, which stems from a default privileg...

OpenClinic GA SQL Injection (CVE-2020-27233; CVE-2020-27234; CVE-2020-27235; CVE-2020-27236; CVE-2020-27237; CVE-2020-27238; CVE-2020-27239; CVE-2020-27240)

An SQL injection vulnerability exists in OpenClinic GA. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

OpenClinic GA SQL Injection (CVE-2020-27241)

An SQL injection vulnerability exists in OpenClinic GA. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2020-27241

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27241

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27240

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27240

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27241

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27241

OpenClinic GA 5.173.3 contains multiple SQL injection vulnerabilities in the getAssets.jsp page (affecting parameters such as serialnumber, code, serviceuid, description, supplierUID, etc.). The underlying cause is insufficient input filtering in the asset query construction, allowing crafted inp...

CVE-2020-27240

CVE-2020-27240 affects OpenClinic GA 5.173.3 where the vulnerability resides in the web UI component GetAssets.jsp. The issue is an SQL injection in the input parameter set of the assets search/ajax endpoint (notably componentStatus and related fields such as supplierUID, serviceuid, description,...

CVE-2020-27240

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability...

PT-2021-11337 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: An exploitable SQL injection issue exists in the getAssets.jsp page. The serialnumber parameter in this page is vulnerable to unauthenticated SQL injection. An attacker can trigger this issue by maki...