SourceCodester Electronic Medical Records System UPDATE Statement register.php pconsultation sql injection

A vulnerability has been found in SourceCodester Electronic Medical Records System and classified as critical. This vulnerability affects unknown code of the file register.php of the component UPDATE Statement Handler. The manipulation of the argument pconsultation leads to sql injection. Using CWE to declare the problem leads to CWE-89. The weakness was released 08/06/2022. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-2693. The attack can be initiated remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The current price for an exploit might be approx. USD $0-$5k at the moment. The MITRE ATT&CK project declares the attack technique as T1505. It is declared as proof-of-concept. It is possible to download the exploit at github.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

141

Field

vulnerability_cvss3_meta_tempscore2
vulnerability_cvss3_meta_basescore2
vulnerability_cvss3_cna_basescore1
vulnerability_cvss3_nvd_basescore1
source_cve_cna1

Commit Conf

90%35
70%19
50%11

Approve Conf

90%35
70%19
80%11
IDCommitedUserFieldChangeRemarksAcceptedStatusC
1292800608/31/2022VulD...cvss3_cna_basescore6.3see CVSS documentation08/31/2022accepted
90
1292800508/31/2022VulD...cvss3_nvd_basescore8.8nist.gov08/31/2022accepted
90
1292800408/31/2022VulD...cvss3_meta_tempscore6.9see CVSS documentation08/31/2022accepted
90
1292800308/31/2022VulD...cvss3_meta_basescore7.1see CVSS documentation08/31/2022accepted
90
1292800208/31/2022VulD...cve_cnaVulDBnvd.nist.gov08/31/2022accepted
70
1292800108/31/2022VulD...cvss3_cna_aLnvd.nist.gov08/31/2022accepted
70
1292800008/31/2022VulD...cvss3_cna_iLnvd.nist.gov08/31/2022accepted
70
1292799908/31/2022VulD...cvss3_cna_cLnvd.nist.gov08/31/2022accepted
70
1292799808/31/2022VulD...cvss3_cna_sUnvd.nist.gov08/31/2022accepted
70
1292799708/31/2022VulD...cvss3_cna_uiNnvd.nist.gov08/31/2022accepted
70
1292799608/31/2022VulD...cvss3_cna_prLnvd.nist.gov08/31/2022accepted
70
1292799508/31/2022VulD...cvss3_cna_acLnvd.nist.gov08/31/2022accepted
70
1292799408/31/2022VulD...cvss3_cna_avNnvd.nist.gov08/31/2022accepted
70
1292799308/31/2022VulD...cvss3_nvd_aHnvd.nist.gov08/31/2022accepted
70
1292799208/31/2022VulD...cvss3_nvd_iHnvd.nist.gov08/31/2022accepted
70
1292799108/31/2022VulD...cvss3_nvd_cHnvd.nist.gov08/31/2022accepted
70
1292799008/31/2022VulD...cvss3_nvd_sUnvd.nist.gov08/31/2022accepted
70
1292798908/31/2022VulD...cvss3_nvd_uiNnvd.nist.gov08/31/2022accepted
70
1292798808/31/2022VulD...cvss3_nvd_prLnvd.nist.gov08/31/2022accepted
70
1292798708/31/2022VulD...cvss3_nvd_acLnvd.nist.gov08/31/2022accepted
70

45 more entries are not shown

Want to stay up to date on a daily basis?

Enable the mail alert feature now!