PT-2017-16580 · Eclinicalworks · Eclinicalworks Patient Portal

Published 2017-01-23 · Updated 2017-01-26 · CVE-2017-5569

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eClinicalWorks Patient Portal version 7.0 build 13

Description An issue was discovered that allows for blind SQL injection within the template.jsp file. This can be exploited without authentication via an HTTP POST request. The issue can be used to dump database data to a malicious server using out-of-band techniques such as select loadfile().

Recommendations For eClinicalWorks Patient Portal version 7.0 build 13, consider restricting access to the template.jsp file until a patch is available. As a temporary workaround, avoid using the vulnerable template.jsp file to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-5569

Affected Products

Eclinicalworks Patient Portal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5569 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5569 · Vendor Advisory
• https://gist.github.com/malerisch/d32d127a002ac1f10bce39333ca9a4dc · Note
• http://securityfocus.com/bid/95741 · Note