SQL Injection Vulnerabilities in phpGACL 3.3.7 by phpGACL
CVE-2020-13567

8.8HIGH

Key Information:

Vendor

Openemr

Status
Openemr
PHPgacl
Vendor
CVE Published:
18 April 2022

What is CVE-2020-13567?

Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. By sending specially crafted HTTP requests, an attacker can manipulate SQL queries leading to unauthorized access to database information.

Affected Version(s)

OpenEMR 5.0.2

OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce)

phpGACL 3.3.7

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.