CVE-2015-4592
HighSummary
eClinicalWorks Population Health (CCMR) has an SQL injection vulnerability in portalUserService.jsp, allowing remote authenticated users to inject arbitrary malicious database commands as part of user input.
Risk Assessment
This vulnerability could lead to unauthorized access to data and data manipulation, posing a serious threat to information security within the organization.
Recommendation
It is recommended to update eClinicalWorks software to the latest version that addresses this vulnerability and to implement additional security measures such as input validation.
Other vulnerabilities in eClinicalWorks Population Health (CCMR)
See all- CVE-2015-4593High
eClinicalWorks Population Health (CCMR) has a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp that allows remote attackers to hijack the authentication of content administrators. This could lead to the creation, modification, and deletion of users, appointments, and employees.
- CVE-2015-4594Critical
eClinicalWorks Population Health (CCMR) has a session fixation vulnerability. The application does not assign a new session ID during user authentication, allowing the use of an existing session ID.
Original NVD description (English source)
eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious database commands as part of user input.