CVE-2022-24831 - CVE House

Back to Database

Status published High CVE-2022-24831

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in OpenClinica

8.3 CVSS

Vulnerability Description

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24831

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenClinica

View All →

OpenClinica Community Edition CRF Data Import ImportCRFData path traversal

OpenClinica Community Edition CRF Data Import ImportCRFData xml injection

Path Traversal in OpenClinica

Affected Vendor

OpenClinica

View all reports →

Affected Software

OpenClinica

Vulnerable Versions:

< 3.13.1, >= 3.14, < 3.14.1, >= 3.15, < 3.15.9, >= 3.16, < 3.16.1

Timeline

Official Publish: May 14th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1213.006 Databases

T1485 Data Destruction