PT-2018-12895

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote attacker authenticated in the patient portal to delete arbitrary files. This is achieved via the docid parameter when the mode is set to delete in the /portal/import...

PT-2018-12894

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote attacker authenticated in the patient portal to read arbitrary files. This is achieved via the docid parameter when the mode is set to get in the /portal/import template.p...

PT-2018-12896

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote attacker authenticated in the patient portal to execute arbitrary PHP code. This is achieved by writing a file with a PHP extension via the docid and content parameters an...