CGM CLININET SQL Injection Vulnerability in ReturnUserUnitsXML.pl Service

A SQL injection vulnerability has been identified in the CGM CLININET software, specifically in the ReturnUserUnitsXML.pl service. The issue arises in the getUserInfo function, where the UserID parameter is improperly sanitized, allowing for malicious SQL code to be injected and potentially executed.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.