Vulnerability Spotlight: Multiple vulnerabilities in Open Clinic’s GA web portal

Summary: Cisco Talos discovered multiple vulnerabilities in OpenClinic GA version 5.173.3, an open-source hospital management web portal used to manage administrative, financial, clinical, lab, x-ray and pharmacy data. The flaws include an unauthenticated command injection (CVE-2020-27227) that can execute commands on the server and potentially exfiltrate the database and user credentials, plus SQL injection issues across several pages and an installation privilege escalation flaw (CVE-2020-27228).
Bottom line: One of these flaws needs no authentication at all: a crafted web request can run commands on the server and expose the database, user credentials and the underlying operating system, in software that holds patient, lab and pharmacy data.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-27226 CVE-2020-27227 CVE-2020-27228 CVE-2020-27229 CVE-2020-27231 CVE-2020-27232 CVE-2020-27233 CVE-2020-27241 CVE-2020-27242 CVE-2020-27246
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026