CVE-2017-5569
CriticalSummary
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13 related to a blind SQL injection in template.jsp. This vulnerability can be exploited without authentication via an HTTP POST request, allowing attackers to dump database data to a malicious server.
Risk Assessment
This vulnerability poses a significant risk to organizations as it allows unauthorized access to database information, potentially leading to a loss of patient confidentiality.
Recommendation
It is recommended to update eClinicalWorks to the latest version to mitigate this vulnerability and implement additional security measures such as input validation.
Original NVD description (English source)
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without the need of authentication and via an HTTP POST request, and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile().