CVE-2020-13568

high · 8.8

SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/edit_group.php, when the POST parameter action is “Submit”, the POST parameter parent_id leads to a SQL injection.

8.8

CVSS

29.7%

EPSS (exploit prob.)

98th

EPSS percentile

2021-04-13

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
open-emr	openemr	5.0.2
phpgacl_project	phpgacl	3.3.7

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-13568