CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

CVE-2022-25471 : OpenEMR 6.0.0 contains an Insecure Direct Object Reference (IDOR). An authenticated attacker can access and modify unauthorized areas by sending a crafted POST to /modules/zend_modules/public/Installer/register. Root cause stated as IDOR; no exploit details or fixes are provided ...

CVE-2022-25471: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

PT-2022-17317

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability. It allows any authenticated attacker to access and modify unauthorized areas. This can be achieved by sending a crafted POST...

OpenEMR 安全漏洞

OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. OpenEMR suffers from a security vulnerability that stems from an insecure...

OpenEMR make_task SQL Injection

The vulnerability of the maketask function in the software for managing medical organizations like OpenEMR is related to the lack of verification of the reliability of XML objects’ sequences. Exploiting this vulnerability allows a malicious actor to carry out attacks based on SQL injections...

OpenEMR < 6.0.0 Patch 3 SQLi Vulnerability

OpenEMR is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

CVE-2021-41843

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

CVE-2021-41843

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

CVE-2021-41843

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

Sql injection

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

CVE-2021-41843

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

CVE-2021-41843

CVE-2021-41843 describes an authenticated SQL injection in the OpenEMR calendar search (calendar/index.php?module=PostCalendar&func=search). The vulnerability resides in the provider_id parameter, allowing an authenticated attacker to read data from all database tables. Affected product/version: ...

CVE-2021-41843

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

OpenEMR SQL Injection Vulnerability (CNVD-2021-103511)

OpenEMR is an open source healthcare management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing applications. openEMR is vulnerable to SQL injection, which can be exploited by...

PT-2021-23428

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 before patch 3 Description An authenticated SQL injection issue in the calendar search function allows an attacker to read data from all tables of the database via the provider id parameter, as demonstrated by the...

CVE-2021-41843: Improper Neutralization of Special Elements used in an SQL Command

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

OpenEMR SQL注入漏洞

OpenEMR is an open source healthcare management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing applications. openEMR is vulnerable to SQL injection, which can be exploited by...

OpenEMR 6.0.0 / 6.1.0-dev SQL Injection

Trovent Security Advisory 2109-01 Authenticated SQL injection in OpenEMR calendar search Overview Advisory ID: TRSA-2109-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2109-01 Affected product: OpenEMR web application Tested versions: 6.0.0,...

OpenEMR 6.0.0 / 6.1.0-dev SQL Injection Vulnerability

OpenEMR versions 6.0.0 and 6.1.0-dev suffer from an authenticated remote SQL injection vulnerability in the calendar search functionality. Authenticated SQL injection in OpenEMR calendar search Overview Advisory version: 1.0 Advisory status: Public Advisory URL:...