PT-2021-21246 · Care2X · Care2X

Published 2021-08-06 · Updated 2021-08-12 · CVE-2021-36351

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Care2x Open Source Hospital Information Management version 2.7 Alpha

Description The issue is related to SQL injection, which occurs via the pday, pmonth, and pyear parameters in GET requests sent to the "/modules/nursing/nursing-station.php" API endpoint. This allows for potential exploitation.

Recommendations For Care2x Open Source Hospital Information Management version 2.7 Alpha, as a temporary workaround, consider restricting access to the "/modules/nursing/nursing-station.php" API endpoint to minimize the risk of exploitation. Avoid using the pday, pmonth, and pyear parameters in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-36351

Affected Products

Care2X

References · 5

• 🔥 https://exploit-db.com/exploits/50165 · Exploit
• https://osv.dev/vulnerability/CVE-2021-36351 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36351 · Security Note
• https://t.me/cvenotify/18783 · Telegram Post
• https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36351 · Note