In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database.

An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content

and/or perform administrative operations including shutting down the database.

In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database.

An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content

and/or perform administrative operations including shutting down the database.

Due to improper sanitation of values of certain parameters, a remote, unauthenticated attacker could potentially run arbitrary SQL queries, access, modify and delete sensitive data and/or administrative operations including shutting down the database. A vulnerability in the application could potentially lead to an unauthorized user gaining access to patient and clinician information, modifying or deleting clinic details.