CVE-2017-5570
HighSummary
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13 related to a blind SQL injection in messageJson.jsp. Authenticated users can exploit this vulnerability to exfiltrate database data to a malicious server using an out-of-band technique.
Risk Assessment
This vulnerability poses a risk of sensitive data leakage from the database to a malicious server, potentially leading to serious breaches of patient privacy and loss of trust in the system.
Recommendation
It is recommended to update the eClinicalWorks system to the latest version to mitigate this vulnerability and to monitor logs for potential exploitation attempts.
Other vulnerabilities in eClinicalWorks Patient Portal 7.0 build 13
Original NVD description (English source)
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the messageJson.jsp, which can only be exploited by authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile().