Description
OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade.
References (2)
Core 2
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h
Patch, Third Party Advisory x_refsource_misc
https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f
Scores
CVSS v3
8.3
EPSS
0.0106
EPSS Percentile
60.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (2)
openclinica/openclinica
3.14
openclinica/openclinica
< 3.13.1
Published
May 14, 2022
Tracked Since
Feb 18, 2026