Description
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CompuGroup Medical | XDent | < 4.4.0 | 4.4.0 |
| CompuGroup Medical | XMedical | < 4.4.0 | 4.4.0 |
References
- https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical government-resource
- https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html government-resource