CVE-2018-15147

OpenEMR

CVE-2018-15153

OpenEMR is affected by an OS command-injection vulnerability in versions before 5.0.1.4. The issue arises when a remote authenticated attacker crafts a request to interface/main/daemon_frame.php after modifying the hylafax_server global variable in interface/super/edit_globals.php. The root cause...

CVE-2018-15148

OpenEMR prior to 5.0.1.4 is vulnerable in interface/patient_file/encounter/search_code.php where the text parameter can be leveraged to perform SQL injection, allowing a remote authenticated attacker to execute arbitrary SQL commands. Affected versions: OpenEMR before 5.0.1.4. Root cause: imprope...

CVE-2018-15152

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access 1 portal/addediteventuser.php, 2 portal/findapptpopupuser.php, 3 portal/getallergies.php, 4 portal/getamendments.php, 5 portal/getlabresults.php, 6...

CVE-2018-15149

SQL injection vulnerability in interface/forms/eyemag/php/Anythingsimple.php from library/forms.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'encounter' parameter...

CVE-2018-15146

SQL injection vulnerability in interface/deidentificationforms/findimmunizationpopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15152

CVE-2018-15152 affects OpenEMR prior to 5.0.1.4. An unauthenticated bypass of portal/account/register.php lets an attacker access multiple portal endpoints (e.g., add_edit_event_user.php, find_appt_popup_user.php, get_lab_results.php, get_medications.php, get_profile.php, portal_payment.php, mess...

CVE-2018-15151

OpenEMR contains a SQL injection vulnerability in interfaces/de_identification_forms/find_code_popup.php prior to 5.0.1.4. An authenticated user can exploit the 'search_term' parameter to execute arbitrary SQL commands, with impact rated as partial confidentiality, integrity, and availability; re...

CVE-2018-15146

OpenEMR is affected by a SQL injection in interface/de_identification_forms/find_immunization_popup.php for versions prior to 5.0.1.4. The vulnerability allows a remote authenticated attacker to execute arbitrary SQL commands through the 'search_term' parameter. Root cause: unsanitized input in t...

CVE-2018-15147

SQL injection vulnerability in interface/formsadmin/formsadmin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter...

CVE-2018-15155

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/faxdispatch.php after modifying the "hylafaxenscript" global variable in interface/super/editglobals.php...

CVE-2018-15151

SQL injection vulnerability in interface/deidentificationforms/findcodepopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15148

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

CVE-2018-15154

OpenEMR versions prior to 5.0.1.4 are affected by an OS command injection vulnerability. An authenticated remote attacker can craft a request to interface/billing/sl_eob_search.php after modifying the print_command global in interface/super/edit_globals.php to execute arbitrary commands. The issu...

CVE-2018-15156

OpenEMR prior to 5.0.1.4 is affected by an OS command injection in interface/fax/faxq.php. An authenticated remote attacker can modify the hylafax_server global in interface/super/edit_globals.php and craft a request to execute arbitrary commands. Exploitation details are documented across multip...

CVE-2018-15155

OS command injection in OpenEMR prior to 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by crafting a request to interfaces/fax/fax_dispatch.php after modifying the hylafax_enscript value in interface/super/edit_globals.php. Affected software: OpenEMR; vulnerable com...

CVE-2018-15149

OpenEMR

CVE-2018-15153

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/main/daemonframe.php after modifying the “hylafaxserver” global variable in interface/super/editglobals.php. Recent...

OpenEMR SQL Injection Vulnerability (CNVD-2019-10145)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in portal/addediteventuser.php in OpenEMR versions prior to 5.0.1.4, which can be exploited by a remote attacker to execute arbitrary SQL commands via the eid,...

OpenEMR SQL Injection Vulnerability (CNVD-2019-10146)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in interface/deidentificationforms/finddrugpopup.php in OpenEMR versions prior to 5.0.1.4, which can be exploited by remote attackers to execute arbitrary SQL...