Vulnerability Details CVE-2017-5570
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the messageJson.jsp, which can only be exploited by authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile().
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 55.0%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2017-5570
-
cpe:2.3:a:eclinicalworks:patient_portal:7.0