PT-2014-6491 · Openemr · Openemr
Published
2014-12-08
·
Updated
2018-08-23
·
CVE-2014-5462
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenEMR versions 4.1.2 (Patch 7) and earlier
Description
The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved through various parameters in different API endpoints, including
layout id to "interface/super/edit layout.php", form patient id, form drug name, or form lot number to "interface/reports/prescriptions report.php", payment id to "interface/billing/edit payment.php", id to "interface/forms admin/forms admin.php", form pid or form encounter to "interface/billing/sl eob search.php", sortby to "interface/logview/logview.php", and several others across different endpoints.Recommendations
For OpenEMR version 4.1.2 (Patch 7) and earlier, consider updating to a newer version that includes a fix for this issue.
As a temporary workaround, restrict access to the vulnerable parameters and endpoints, such as
layout id, form patient id, form drug name, form lot number, payment id, id, form pid, form encounter, and sortby, until a patch is available.
Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openemr