SQL Injection Vulnerability in phpGACL by phpGACL Project
CVE-2020-13568

8.8HIGH

Key Information:

Vendor

Open-emr

Status
PHPgacl
Vendor
CVE Published:
13 April 2021

What is CVE-2020-13568?

A SQL injection vulnerability has been identified in phpGACL version 3.3.7, specifically in the admin/edit_group.php file. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with the POST parameter 'action' set to 'Submit'. By manipulating the 'parent_id' parameter, an attacker can execute arbitrary SQL queries, which may lead to unauthorized data access or compromise of the database.

Affected Version(s)

phpGACL OpenEMR 5.0.2, OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce), phpGACL 3.3.7

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.