CVE-2019-14937: SQL Injection
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the calid parameter, such as calid=55 and sleep(3) to Calendar/calendarpopupajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-14937.
What is the title of this vulnerability?
The title of this vulnerability is REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter.
What is the severity of CVE-2019-14937?
The severity of CVE-2019-14937 is high with a CVSS score of 7.5.
How can an attacker exploit CVE-2019-14937?
An attacker can exploit CVE-2019-14937 by injecting time-based SQL statements through the cal_id parameter in the edit calendar event.
How can I mitigate the risk of CVE-2019-14937?
To mitigate the risk of CVE-2019-14937, update REDCap to version 9.3.0 or later.