OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries.
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openclinic_ga | Openclinic_ga_project | 5.09.02 (including) | 5.09.02 (including) |
| Openclinic_ga | Openclinic_ga_project | 5.89.05b (including) | 5.89.05b (including) |