CVE-2020-13568: 
OpenEMR vulnerability analysis and mitigation

A SQL injection vulnerability exists in phpGACL 3.3.7, identified as CVE-2020-13568. The vulnerability was discovered in the groupid parameter handling within the admin/editgroup.php file. This vulnerability affects both phpGACL 3.3.7 and OpenEMR versions 5.0.2 and development version 6.0.0 (Talos Report).

The vulnerability occurs when the POST parameter action is 'Submit' and the groupid parameter is passed to the editgroup function unsanitized. The function editgroup calls getgroupdata using the unsanitized groupid, where it is directly concatenated into an SQL query without proper sanitization. The vulnerability has been assigned a CVSSv3 score of 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (Talos Report).

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to execute arbitrary SQL commands in the context of the database user. This could potentially lead to unauthorized access to sensitive data, manipulation of database contents, or other malicious database operations (Talos Report).

The vulnerability was patched by the vendor on January 5, 2021. Users should upgrade to the latest version of phpGACL that includes the security fix (Talos Report).