CVE-2022-3120

CWE-89 — SQL InjectionCWE-284 — Improper Access Control4 documents4 sources
Severity
9.8CRITICAL
EPSS
0.3%
top 45.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Clinics Patient Management SystemOretnom23 Clinic\'s Patient Management System
Timeline
PublishedSep 5
Latest updateSep 6

Description

A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-207847.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-vhmw-q23p-pgq3: A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System↗2022-09-06
▶
CVEList
SourceCodester Clinics Patient Management System Login index.php sql injection↗2022-09-05
▶

📋Vendor Advisories

1
CISA
Elasticsearch Remote Code Execution Vulnerability↗2022-03-25
▶
CVE-2022-3120 (CRITICAL CVSS 9.8) | A vulnerability classified as criti | cvebase.io