PT-2023-18807 · Openemr · Openemr

Dennis Brinkrolf · Published 2023-02-22 · Updated 2023-03-03 · CVE-2023-22973

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.0

Description A Local File Inclusion (LFI) issue in the interface/forms/LBF/new.php file allows remote authenticated users to execute code via the formname parameter. This can be exploited by authenticated users, potentially leading to code execution.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/forms/LBF/new.php file or disabling the formname parameter in the affected API endpoint until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-22973

Affected Products

Openemr

References · 6

• 🔥 https://sonarsource.com/blog/openemr-remote-code-execution-in-your-healthcare-system · Exploit
• https://open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29 · Patch
• https://osv.dev/vulnerability/CVE-2023-22973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22973 · Security Note
• https://t.me/cibsecurity/58723 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22973 · Note