CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: redcap before 9.3.0 allows time-based sql injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to calendar/calendar_popup_ajax.php. the attacker can obtain a user's login sessionid from the database, and then re-login into redcap to compromise all data.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-08-17
Last Modified Date: 2019-08-27