Callvision Healthcare Callvision Emergency Code SQL Injection Vulnerability

A SQL injection vulnerability, allowing both standard and blind SQL injection, has been identified in Callvision Healthcare's Callvision Emergency Code application, affecting versions prior to 3.0. This vulnerability arises from improper neutralization of special elements used in SQL commands, which could enable cyber attackers to execute malicious SQL queries and potentially manipulate the application's database.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users and system administrators are advised to upgrade the application to version 3.0 or later.