LibreHealth 2.0.0 Remote Code Execution Exploit

Exploit Title: LibreHealth v2.0.0 - Authenticated Remote Code Execution Exploit Author: Bobby Cooke Vendor Homepage: https://librehealth.io/ Software Link: https://github.com/LibreHealthIO/lh-ehr Version: 2.0.0 Tested On: Windows 10 Pro 1909 x6486 + XAMPP 7.4.4 Exploit Tested Using: Python 2.7.17...

CVE-2020-11438

LibreHealth EMR v2.0.0 is affected by systemic CSRF...

CVE-2020-11439

LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application...

CVE-2020-11436

LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators...

CVE-2020-11437

LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database...

CVE-2020-11437

LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database...

CVE-2020-11436

LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators...

CVE-2020-11438

LibreHealth EMR v2.0.0 is affected by systemic CSRF...

CVE-2020-11439

LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application...

Sql injection

LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database...

Cross site request forgery (csrf)

LibreHealth EMR v2.0.0 is affected by systemic CSRF...

Design/Logic Flaw

LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators...

CVE-2020-11438

CVE-2020-11438 concerns LibreHealth EMR v2.0.0, where a systemic CSRF vulnerability is reported. The connected records characterize the issue as a cross-site request forgery affecting LibreHealth EMR 2.0.0, with attacker‑summoned unintended requests via a compromised or tricked environment, per s...

CVE-2020-11438

LibreHealth EMR v2.0.0 is affected by systemic CSRF...

CVE-2020-11436

LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators...

CVE-2020-11436

LibreHealth EMR v2.0.0 is reported vulnerable to cross-site scripting (XSS) that can force arbitrary actions on behalf of other users, including administrators. The connected sources confirm the affected product and the impact (unauthorized actions by different user roles), but they do not provid...

CVE-2020-11437

LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database...

CVE-2020-11437

CVE-2020-11437 affects LibreHealth EMR v2.0.0. The vulnerability is a SQL injection that allows low-privilege authenticated users to enumerate the database. The available documents confirm the affected product/version and the impact (database enumeration), but do not provide remediation steps or ...

CVE-2020-11439

LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application...

CVE-2020-11439

CVE-2020-11439 affects LibreHealth EMR v2.0.0. The connected sources describe a Local File Inclusion vulnerability that enables inclusion and execution of arbitrary PHP within the EMR application. The datasets consistently identify the impact as arbitrary code execution via LFI, but do not provid...