RemoteClinic vulnerabilities

A vulnerability was detected in RemoteClinic 2.0 affecting unknown code in /staff/profile.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely.

A vulnerability was found in RemoteClinic up to version 2.0 affecting the file /patients/edit-patient.php. Manipulation of the Email argument leads to information disclosure. The attack can be launched remotely and the exploit is publicly available.

A flaw was found in RemoteClinic up to 2.0 affecting unknown code of the /staff/edit.php file. Manipulating the Last Name argument leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been published.