Description
Clinic Pro contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the month parameter. Attackers can send POST requests to the monthly_expense_overview endpoint with crafted month values using boolean-based blind, time-based blind, or error-based SQL injection techniques to extract sensitive database information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Softwebinternational | Clinic Pro | — | — |
References
- ExploitDB-46642 exploit
- VulnCheck Advisory: Clinic Pro SQL Injection via monthly_expense_overview month Parameter third-party-advisory