Vulnerability-Lookup

CNVD-2017-01321

Vulnerability from cnvd - Published: 2017-02-14

Title

eClinicalWorks Patient Portal SQL注入漏洞（CNVD-2017-01321）

Description

eClinicalWorks Patient Portal是美国eClinicalWorks公司的一款应用于医疗领域的产品，该产品为患者提供了一个安全的查看他们的个人健康记录（PHR）和查看化验结果等的通信方式。 eClinicalWorks Patient Portal 7.0 build 13版本中的template.jsp文件存在SQL注入漏洞。攻击者可通过发送HTTP POST请求利用该漏洞将数据库数据转储到恶意的服务器。

Severity

高

Patch Name

eClinicalWorks Patient Portal SQL注入漏洞（CNVD-2017-01321）的补丁

Patch Description

Formal description

用户可联系供应商获得补丁信息： https://www.eclinicalworks.com

Reference

http://www.securityfocus.com/bid/95741

Impacted products

Name
EClinicalWorks Patient Portal 7.0 build 13

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "95741"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5569",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5569"
    }
  },
  "description": "eClinicalWorks Patient Portal\u662f\u7f8e\u56fdeClinicalWorks\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u4e8e\u533b\u7597\u9886\u57df\u7684\u4ea7\u54c1\uff0c\u8be5\u4ea7\u54c1\u4e3a\u60a3\u8005\u63d0\u4f9b\u4e86\u4e00\u4e2a\u5b89\u5168\u7684\u67e5\u770b\u4ed6\u4eec\u7684\u4e2a\u4eba\u5065\u5eb7\u8bb0\u5f55\uff08PHR\uff09\u548c\u67e5\u770b\u5316\u9a8c\u7ed3\u679c\u7b49\u7684\u901a\u4fe1\u65b9\u5f0f\u3002\r\n\r\neClinicalWorks Patient Portal 7.0 build 13\u7248\u672c\u4e2d\u7684template.jsp\u6587\u4ef6\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001HTTP POST\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6570\u636e\u5e93\u6570\u636e\u8f6c\u50a8\u5230\u6076\u610f\u7684\u670d\u52a1\u5668\u3002",
  "discovererName": "eClinicalWorks",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.eclinicalworks.com",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-01321",
  "openTime": "2017-02-14",
  "patchDescription": "eClinicalWorks Patient Portal\u662f\u7f8e\u56fdeClinicalWorks\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u4e8e\u533b\u7597\u9886\u57df\u7684\u4ea7\u54c1\uff0c\u8be5\u4ea7\u54c1\u4e3a\u60a3\u8005\u63d0\u4f9b\u4e86\u4e00\u4e2a\u5b89\u5168\u7684\u67e5\u770b\u4ed6\u4eec\u7684\u4e2a\u4eba\u5065\u5eb7\u8bb0\u5f55\uff08PHR\uff09\u548c\u67e5\u770b\u5316\u9a8c\u7ed3\u679c\u7b49\u7684\u901a\u4fe1\u65b9\u5f0f\u3002\r\n\r\neClinicalWorks Patient Portal 7.0 build 13\u7248\u672c\u4e2d\u7684template.jsp\u6587\u4ef6\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001HTTP POST\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6570\u636e\u5e93\u6570\u636e\u8f6c\u50a8\u5230\u6076\u610f\u7684\u670d\u52a1\u5668\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "eClinicalWorks Patient Portal SQL\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2017-01321\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "EClinicalWorks Patient Portal 7.0 build 13"
  },
  "referenceLink": "http://www.securityfocus.com/bid/95741",
  "serverity": "\u9ad8",
  "submitTime": "2017-02-08",
  "title": "eClinicalWorks Patient Portal SQL\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2017-01321\uff09"
}

CVE-2017-5569 (GCVE-0-2017-5569)

Vulnerability from cvelistv5 – Published: 2017-01-23 17:00 – Updated: 2024-08-05 15:04

Summary

An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without the need of authentication and via an HTTP POST request, and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile().

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
http://www.securityfocus.com/bid/95741	vdb-entryx_refsource_BID
https://gist.github.com/malerisch/d32d127a002ac1f…	x_refsource_MISC

Date Public ?

2017-01-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:15.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "95741",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95741"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/malerisch/d32d127a002ac1f10bce39333ca9a4dc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-01-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without the need of authentication and via an HTTP POST request, and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile()."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-01-25T10:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "95741",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95741"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/malerisch/d32d127a002ac1f10bce39333ca9a4dc"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-5569",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without the need of authentication and via an HTTP POST request, and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile()."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "95741",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95741"
            },
            {
              "name": "https://gist.github.com/malerisch/d32d127a002ac1f10bce39333ca9a4dc",
              "refsource": "MISC",
              "url": "https://gist.github.com/malerisch/d32d127a002ac1f10bce39333ca9a4dc"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-5569",
    "datePublished": "2017-01-23T17:00:00.000Z",
    "dateReserved": "2017-01-23T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:15.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-01321

CVE-2017-5569 (GCVE-0-2017-5569)

Tags

Sightings

Nomenclature