CVE-2017-7351

CVE-2017-7351 describes a critical SQL injection vulnerability within the file upload handler of REDCap 7.x versions prior to 7.0.11. This flaw allows an authenticated attacker to execute arbitrary SQL commands by manipulating a trailing substring in the SendITController:upload function. With a CVSS score of 8.8 (High), successful exploitation could lead to complete compromise of confidentiality, integrity, and availability of the affected system. While no public exploits, Metasploit modules, or Nuclei templates are currently available, and there is no evidence of active exploitation, the high severity and ease of exploitation (low attack complexity, no user interaction) warrant attention.