CVE-2015-4453

OpenEMR vulnerable component: interface/globals.php. Root cause: a bug in the implementation of the legacy (fake) register_globals handling allows an ignoreAuth=1 parameter to bypass authentication. Affected versions: OpenEMR 2.x, 3.x, and 4.x up to 4.2.0 patch 2. Impact: remote attackers can acc...

CVE-2015-4453: Improper Authentication

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by 1 interface/fax/faxdispatchnewpid.php and 2 interface/billing/sleobsearch.php...

OpenEMR vulnerable to authentication bypass

Overview OpenEMR is an electronic health records and medical practice management application. OpenEMR contains an authentication bypass vulnerability CWE-302. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#22677713: OpenEMR vulnerable to authentication bypass

OpenEMR is an electronic health records and medical practice management application. OpenEMR contains an authentication bypass vulnerability CWE-302. Impact Sensitive information may be obtained by a remote attacker who can access the web interface of the product. Solution Update the software and...

OpenEMR 4.2.0 Authentication Bypass Vulnerability

OpenEMR versions 4.2.0 and 4.2.0 patch 1 suffer from an authentication bypass vulnerability. Title: Authentication bypass in OpenEMR CVE Reference: CVE-2015-4453 Product: OpenEMR Vendor: http://www.open-emr.org/ Tested versions: 4.2.0 and 4.2.0 patch 1 Affected versions: 2.8.3 to 4.2.0 patch 1...

OpenEMR 'validateUser.php' SQLi Vulnerability - Active Check

OpenEMR is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

OpenEMR 4.1.2 forms_admin.php SQL Injection

SQL Injection vulnerability in OpenEMR formsadmin.php id parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

OpenEMR 4.1.1 new_comprehensive_save.php SQL Injection

SQL Injection vulnerability in OpenEMR newcomprehensivesave.php formpubpid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

OpenEMR 4.1.1 logview.php SQL Injection

SQL Injection vulnerability in OpenEMR logview sortby parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

OpenEMR 4.1.2(7) - Multiple SQL Injections

Vulnerability title: Multiple Authenticated SQL Injections In OpenEMR CVE: CVE-2014-5462 Vendor: OpenEMR Product: OpenEMR Affected version: 4.1.27 and earlier Fixed version: N/A Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed within the software as an authenticated...

OpenEMR 4.1.2(7) - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications Vulnerability title: Multiple Authenticated SQL Injections In OpenEMR CVE: CVE-2014-5462 Vendor: OpenEMR Product: OpenEMR Affected version: 4.1.27 and earlier Fixed version: N/A Reported by: Jerzy Kramarz Details: SQL injection has been found...

OpenEMR 4.1.2(7) - Multiple SQL Injections

OpenEMR 4.1.27 - Multiple SQL Injections Vulnerability title: Multiple Authenticated SQL Injections In OpenEMR CVE: CVE-2014-5462 Vendor: OpenEMR Product: OpenEMR Affected version: 4.1.27 and earlier Fixed version: N/A Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed...

CVE-2014-5462

Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 Patch 7 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 layoutid parameter to interface/super/editlayout.php; 2 formpatientid, 3 formdrugname, or 4 formlotnumber parameter to...

Sql injection

Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 Patch 7 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 layoutid parameter to interface/super/editlayout.php; 2 formpatientid, 3 formdrugname, or 4 formlotnumber parameter to...

CVE-2014-5462

Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 Patch 7 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 layoutid parameter to interface/super/editlayout.php; 2 formpatientid, 3 formdrugname, or 4 formlotnumber parameter to...

CVE-2014-5462

OpenEMR 4.1.2 (Patch 7) and earlier contain multiple SQL injection vulnerabilities exploitable by remote authenticated users. Affected components include interface/super/edit_layout.php (layout_id), interface/reports/prescriptions_report.php (several), interface/billing/edit_payment.php, interfac...

CVE-2014-5462: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 Patch 7 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 layoutid parameter to interface/super/editlayout.php; 2 formpatientid, 3 formdrugname, or 4 formlotnumber parameter to...

OpenEMR 4.1.2(7) SQL Injection

Vulnerability title: Multiple Authenticated SQL Injections In OpenEMR CVE: CVE-2014-5462 Vendor: OpenEMR Product: OpenEMR Affected version: 4.1.27 and earlier Fixed version: N/A Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed within the software as an authenticated...

Openemr-4.1.0 - SQL Injection Vulnerability

No description provided by source. Exploit Title: Openemr-4.1.0 SQL injection Vulnerability Date: 2011/10/18 Author: I2sec-dae jin Oh Software Link: http://sourceforge.net/projects/openemr/files/OpenEMR%20Current/4.1.0/openemr-4.1.0.zip/download Vendor : www.open-emr.com Version: Openemr-4.1.0...

OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...