SQL injections in web applications of a Swiss health information center allowed an attacker to execute arbitrary SQL commands
Swiss Health Sector
NTCF:
NTCF-2023-99623
Product:
Classified
Vendor:
Classified
Criticality:
high
Status:
fixed
Discovered:
2023-09-14
Detail:
Classified
Description
In accordance with the NTC Vulnerability Disclosure Policy, the details of this vulnerability will not be publicly disclosed.
Neither the product and vendor name nor a detailed description of the vulnerability will be publicly released if all of the following conditions are met:
- the vendor fixes the vulnerability without requiring any action by the affected parties (e.g. a cloud service where the user is not required to install patches)
- there is no indication that the vulnerability has been exploited (e.g. in the log files)
Further details may be provided on request. Please use the contact form.
Timeline
2023-09-14: initial discovery
2023-09-18: first contact to vendor
2023-09-29: contact by phone: feedback promised by vendor
2023-11-06: reminder sent by email to vendor
2023-11-14: phone call: vendor agreed to the disclosure by e-mail
2023-12-14: private disclosure to vendor
2024-02-07: email request for current status to vendor
2024-05-24: email request for status update to vendor
2024-06-25: no answer by vendor: escalation to NCSC
2024-07-05: NCSC contacted the vendor
2024-07-31: fix by vendor
2024-08-28: public disclosure