E-Logbook Health Monitoring System for COVID-19 SQL Injection Risk

Summary

An attacker can access sensitive data in the E-Logbook Health Monitoring System for COVID-19 by sending malicious input. This could lead to unauthorized access to sensitive information. To mitigate this risk, update to the latest version of the system or apply a patch if available.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
emiloi	e-logbook_with_health_monitoring_system_for_covid-19	1.0	–

Original title

A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The ...

Original description

A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/ltranquility/cve_submit/issues/3 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.347406 Permissions Required VDB Entry
https://vuldb.com/?id.347406 Third Party Advisory VDB Entry
https://vuldb.com/?submit.757247 Third Party Advisory VDB Entry