What’s Vulnerable › Vulnerabilities

CVE-2022-24831: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in OpenClinica

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-14 · updated 2026-06-17
• Weakness: CWE-89

Description

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade.

Affected products

• OpenClinica: before 3.13.1; from 3.15 (excl.) before 3.15.9; from 3.16 (excl.) before 3.16.1; 3.14 — fixed in 3.13.1, 3.15.9, 3.16.1

How to fix

Upgrade to a fixed version: OpenClinica 3.13.1, 3.15.9, 3.16.1. Check the vendor advisory for mitigations.

References

• https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f
• https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h
• https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f
• https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h

Get alerted when CVE-2022-24831 or the next vulnerability affects your stack