Vulnerability Spotlight: Multiple vulnerabilities in OpenClinic’s GA web portal
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-27226 | An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. NVD description · AI analysis pending | 8.8 | 1% | PoC |
| — | |
| CVE-2020-27227 | An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the server. An attacker can send a web request with parameters containing specific parameter to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and compromise underlying operating system. NVD description · AI analysis pending | 9.8 group max | 3% | PoC |
| — | |
| CVE-2020-27241 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. NVD description · AI analysis pending | 9.8 | <1% | PoC |
| — | |
| CVE-2020-27242 +1 in the same advisory: …27246 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. NVD description · AI analysis pending | 8.8 | <1% | PoC |
| — |
Full article597 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, April 13, 2021 10:40
Yuri Kramarz of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in OpenClinic’s GA web portal. OpenClinic GA
is an open-source, fully integrated hospital management solution. The web portal allows users to manage administrative, financial, clinical, lab, x-ray and pharmacy data for health care facilities. The software contains extensive statistical and reporting capabilities. OpenClinic GA contains several vulnerabilities that could allow an adversary to carrot out a wide range of malicious actions, including injecting SQL code into the targeted server or elevating their privileges.
In accordance with our coordinated disclosure policy, Cisco Talos worked with OpenClinic to disclose these vulnerabilities and ensure that updates are available.
Vulnerability details
OpenClinic GA web portal SQL injection vulnerability in 'statistics/quickFile.jsp' page (TALOS-2020-1202/CVE-2020-27226)
An exploitable SQL injection vulnerability exists in 'quickFile.jsp' page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Read the complete vulnerability advisory here for additional information.
OpenClinic GA unauthenticated command injection vulnerability (TALOS-2020-1203/CVE-2020-27227)
An exploitable unauthenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the server. An attacker can send a web request with parameters containing specific parameters to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and compromise of the underlying operating system.
Read the complete vulnerability advisory here for additional information.
OpenClinic GA installation privilege escalation vulnerability (TALOS-2020-1204/CVE-2020-27228)
An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privilege escalation. An attacker can replace a file to exploit this vulnerability.
Read the complete vulnerability advisory here for additional information.
OpenClinic GA web portal multiple SQL injection vulnerabilities in 'patientslist.do' page (TALOS-2020-1205/CVE-2020-27229 - CVE-2020-27231)
Multiple exploitable SQL injection vulnerabilities exist in the 'patientslist.do' page of OpenClinic GA 5.173.3 application. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Read the complete vulnerability advisory here for additional information.
OpenClinic GA Web portal SQL injection vulnerability in 'manageServiceStocks.jsp' page (TALOS-2020-1206/CVE-2020-27232)
An exploitable SQL injection vulnerability exists in the 'manageServiceStocks.jsp' page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Read the complete vulnerability advisory here for additional information.
OpenClinic GA web portal multiple SQL injection vulnerabilities in 'getAssets.jsp' page (TALOS-2020-1207/CVE-2020-27233 - CVE-2020-27241)
Multiple exploitable SQL injection vulnerabilities exist in the 'getAssets.jsp' page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Read the complete vulnerability advisory here for additional information.
OpenClinic GA web portal multiple SQL injection vulnerabilities in 'listImmoLabels.jsp' page (TALOS-2020-1208/CVE-2020-27242 - CVE-2020-27246)
Multiple exploitable SQL injection vulnerabilities exist in the 'listImmoLabels.jsp' page of OpenClinic GA 5.173.3 application. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Read the complete vulnerability advisory here for additional information.
Versions tested
Talos tested and confirmed that these vulnerabilities affect OpenClinic GA, version 5.173.3.
Coverage
The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.
Snort Rules: 56475 - 56483, 56486 - 56489
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vuln-spotlight-open-clinic-we/