An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
Link | Resource |
---|---|
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207 | Exploit Technical Description Third Party Advisory |
Configurations
History
21 Apr 2021, 14:37
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
CWE | CWE-89 | |
References | (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207 - Exploit, Technical Description, Third Party Advisory | |
CPE | cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.173.3:*:*:*:*:*:*:* |
15 Apr 2021, 14:37
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-04-15 14:15
Updated : 2023-12-10 13:55
NVD link : CVE-2020-27238
Mitre link : CVE-2020-27238
CVE.ORG link : CVE-2020-27238
JSON object : View
Products Affected
openclinic_ga_project
- openclinic_ga
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')