PT-2017-16580 · Eclinicalworks · Eclinicalworks Patient Portal

Publicado 2017-01-23 · Atualizado 2017-01-26 · CVE-2017-5569

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eClinicalWorks Patient Portal version 7.0 build 13

Description An issue was discovered that allows for blind SQL injection within the template.jsp file. This can be exploited without authentication via an HTTP POST request. The issue can be used to dump database data to a malicious server using out-of-band techniques such as select loadfile().

Recommendations For eClinicalWorks Patient Portal version 7.0 build 13, consider restricting access to the template.jsp file until a patch is available. As a temporary workaround, avoid using the vulnerable template.jsp file to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-5569

Produtos afetados

Eclinicalworks Patient Portal

Referências · 4

• https://gist.github.com/malerisch/d32d127a002ac1f10bce39333ca9a4dc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5569 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5569 · Aviso do Fabricante
• http://securityfocus.com/bid/95741 · Nota