SQL Injection Vulnerability in phpGACL by phpGACL Team
CVE-2020-13566

8.8HIGH

Key Information:

Vendor

Open-emr

Status
PHPgacl
Vendor
CVE Published:
13 April 2021

What is CVE-2020-13566?

phpGACL version 3.3.7 is susceptible to SQL injection when attackers manipulate the POST parameters in specific HTTP requests. Particularly, if the 'action' parameter is set to 'Delete', the 'delete_group' parameter can be crafted to execute arbitrary SQL commands, compromising the database integrity. This vulnerability enables attackers to potentially gain unauthorized access to sensitive data, highlighting the necessity for immediate patching and implementation of secure coding practices.

Affected Version(s)

phpGACL phpGACL 3.3.7

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.