Description (CNA)
A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe (aka U+FF07) in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xp_cmdshell.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://www.blacklanternsecurity.com/blog/
- https://www.cerner.com/solutions/mobility
- https://www.blacklanternsecurity.com/2021-08-13-Cerner-MobileCare-CVE/
ADP enrichment
No English description supplied.