Vulnerability · Published Apr 18, 2022 · Assigned by talos

CVE-2020-13567

High 8.8

In plain English

A high-severity SQL injection in OpenEMR from OpenEMR. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.0)8.8High

Exploit odds (30 days)2.3%top 16.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
OpenEMR	OpenEMR	5.0.2development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce)
phpGACL	phpGACL	3.3.7

Weakness: CWE-89 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179 x_refsource_MISC