CVE-2020-13566: SQL Injection

Published Apr 13, 2021

Updated

SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/editgroup.php, when the POST parameter action is “Delete”, the POST parameter deletegroup leads to a SQL injection.

Affected Software

2 affected components

open-emr Openemr=5.0.2

Phpgacl Project Phpgacl=3.3.7

Event History

Apr 13, 2021

CVE Published

via MITRE·02:59 PM

Data Sourced

via MITRE·02:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-13566?

The severity of CVE-2020-13566 is high (8.8).

What is the affected software for CVE-2020-13566?

The affected software for CVE-2020-13566 is Open-emr 5.0.2 and Phpgacl Project Phpgacl 3.3.7.

What is the vulnerability description of CVE-2020-13566?

CVE-2020-13566 is a SQL injection vulnerability in phpGACL 3.3.7 that can be exploited through a specially crafted HTTP request.

How can an attacker exploit CVE-2020-13566?

An attacker can exploit CVE-2020-13566 by sending a specially crafted HTTP request to the admin/edit_group.php page with the POST parameter action set to "Delete" and the POST parameter delete_group leading to a SQL injection.

Is there a fix for CVE-2020-13566?

There is no specific fix mentioned for CVE-2020-13566, but it is recommended to update to a patched version of phpGACL to address this vulnerability.