CVE-2020-13568: SQL Injection

Published Apr 13, 2021

Updated

SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/editgroup.php, when the POST parameter action is “Submit”, the POST parameter parentid leads to a SQL injection.

Affected Software

2 affected components

open-emr Openemr=5.0.2

Phpgacl Project Phpgacl=3.3.7

Event History

Apr 13, 2021

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-13568?

CVE-2020-13568 is a SQL injection vulnerability found in phpGACL 3.3.7.

What is the severity of CVE-2020-13568?

CVE-2020-13568 has a severity rating of 8.8 (high).

How does CVE-2020-13568 work?

CVE-2020-13568 can be triggered by sending a specially crafted HTTP request to the admin/edit_group.php file in phpGACL 3.3.7, where the POST parameter action is set to "Submit" and the POST parameter parent_id is manipulated to perform a SQL injection attack.

Which software versions are affected by CVE-2020-13568?

Open-emr Openemr version 5.0.2 and Phpgacl Project Phpgacl version 3.3.7 are affected by CVE-2020-13568.

How can I fix CVE-2020-13568?

To fix CVE-2020-13568, it is recommended to update phpGACL to a version that includes the necessary security patches.