CVE-2020-13566: 
OpenEMR vulnerability analysis and mitigation

Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7, identified as CVE-2020-13566. The vulnerability was discovered in the phpGACL library, which allows developers to implement permission systems via a Generic Access Control List. A specially crafted HTTP request can lead to SQL injection, potentially compromising the security of systems using this library. The vulnerability was discovered by Claudio Bozzato of Cisco Talos and was publicly disclosed on January 27, 2021 (Talos Report).

The vulnerability exists due to unsanitized SQL queries built using string concatenation across the phpGACL codebase. Specifically, in admin/edit_group.php, when the POST parameter action is 'Delete', the POST parameter delete_group leads to SQL injection. The delete_group parameter is passed to the del_group function without proper sanitization. The vulnerability has a CVSSv3 Score of 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (Talos Report).

The SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the affected database. This could potentially lead to unauthorized access to sensitive data, modification of database contents, or compromise of the entire system's integrity (Talos Report).

The vulnerability can be exploited by sending a specially crafted HTTP request to the target system. A proof of concept exploit has been demonstrated using a curl command with specific parameters targeting the edit_group.php endpoint. The vulnerability affects OpenEMR 5.0.2 and development version 6.0.0, as well as phpGACL 3.3.7 (Talos Report).

The vulnerability was patched by the vendor on January 5, 2021. Users are advised to update to the latest version of phpGACL that includes the security fix. Organizations using OpenEMR should also ensure they are running the latest patched version of the software (Talos Report).