Vulnerability Spotlight: Multiple vulnerabilities in phpGACL class
Summary: Cisco Talos discovered multiple vulnerabilities in the phpGACL PHP library, version 3.3.7, including cross-site scripting flaws (CVE-2020-13562 through CVE-2020-13564), an open redirect in return_page (CVE-2020-13565), and SQL injection flaws (CVE-2020-13566 through CVE-2020-13568), all triggered by crafted HTTP requests or URLs. A separate cross-site request forgery vulnerability (CVE-2020-13569) affects the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0, and Talos confirmed the XSS and SQL injection issues also affect those OpenEMR versions.
What's compelling: These flaws land in OpenEMR, medical practice management software, where a crafted request can execute arbitrary JavaScript, inject SQL, or run requests in a victim's context - and Talos has published Snort rules 56143 through 56149 and 56152 through 56153 to detect exploitation attempts.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-13562CVE-2020-13564CVE-2020-13565CVE-2020-13566CVE-2020-13568CVE-2020-13569
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026