A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openclinic_ga | Openclinic_ga_project | 5.09.02 | 5.09.02 |
| Openclinic_ga | Openclinic_ga_project | 5.89.05b | 5.89.05b |