CVE-2022-24831 is a critical SQL injection vulnerability affecting OpenClinica, an open-source Electronic Data Capture and Clinical Data Management software, in versions prior to 3.16.1. This flaw stems from the use of string concatenation for SQL query construction, allowing unauthenticated attackers to execute arbitrary SQL commands. With a CVSS score of 9.8 (CRITICAL), successful exploitation could lead to complete compromise of confidentiality, integrity, and availability of the affected system. While no active exploitation or public exploit code is currently known, and community discussion is minimal, users are strongly advised to upgrade to patched versions (3.16.1, 3.15.9, 3.14.1, or 3.13.1) as no workarounds exist.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.13.1CPE matchmatch criteria | cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:* | ||
> 3.15, < 3.15.9CPE matchmatch criteria | cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:* | ||
> 3.16, < 3.16.1CPE matchmatch criteria | cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:* | ||
3.14CPE matchmatch criteria | cpe:2.3:a:openclinica:openclinica:3.14:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.