OpenEMR Arbitrary SQL Command Execution Vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the interface\super\editlist.php file ...

CVE-2018-9250

interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...

PT-2018-18932

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the newlistname parameter in the 'interfacesuperedit list.php' file. Recommendations For versions...

CVE-2018-9250: Improper Neutralization of Special Elements used in an SQL Command

interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...