PT-2018-9503

Name of the Vulnerable Software and Affected Versions LibreHealthIO lh-ehr version REL-2.0.0 Description The issue concerns a SQL Injection vulnerability in the Show Groups Popup SQL query functions. This can allow an attacker to perform malicious database queries. The attack is exploitable via...

PT-2018-9498

Name of the Vulnerable Software and Affected Versions LibreHealthIO lh-ehr versions prior to 2.0.0 Description The issue allows for local file disclosure, which can result in the disclosure of sensitive files on the server. This is exploitable via a user-controlled variable in the import template...

PT-2018-9500

Name of the Vulnerable Software and Affected Versions LibreHealthIO lh-ehr version REL-2.0.0 Description The issue concerns an authenticated unrestricted file deletion that can lead to a denial of service. This is exploitable via a user-controlled parameter in the Import template. Recommendations...

PT-2018-9502

Name of the Vulnerable Software and Affected Versions LibreHealthIO lh-ehr version REL-2.0.0 Description The issue concerns an authenticated unrestricted file write vulnerability in the letter.php file, specifically within patient file letter functions. This vulnerability can lead to writing file...

PT-2018-9499

Name of the Vulnerable Software and Affected Versions LibreHealthIO LH-EHR version REL-2.0.0 Description The issue concerns an Authenticated Unrestricted File Write vulnerability in the Import template, which can lead to writing files with malicious content and potentially result in remote code...

PT-2018-9501

Name of the Vulnerable Software and Affected Versions LibreHealthIO lh-ehr version REL-2.0.0 Description The issue concerns an authenticated unrestricted file write vulnerability in patient file letter functions. This can lead to writing files with malicious content, potentially resulting in remo...

CVE-2018-1000646: Unrestricted Upload of File with Dangerous Type

LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in write files with malicious content and may lead to remote code execution...

CVE-2018-1000649: Incorrect Permission Assignment for Critical Resource

LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php 2 vulnerability in Patient file letter functions that can result in Write files with malicious content and may lead to remote code execution. This attack appear to be exploitable via User...

CVE-2018-1000647: Improper Input Validation

LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result in Denial of service. This attack appear to be exploitable via User controlled parameter...

CVE-2018-1000648: Improper Privilege Management

LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that can result in Write files with malicious content and may lead to remote code execution. This attack appear to be exploitable via User controlled parameters...