CVE-2019-14937

published 2019-08-17

CVE-2019-14937: REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to…

Priority P3 43 high 7.5 CVSS 3.0

AV N AC H PR L UI N S U C H I H A H

REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
vanderbilt	redcap	>= 8.11.5 < 9.3.0	9.3.0

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.0 MEDIUM AV:N/AC:M/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89