CVE-2018-15147

OpenEMR

CVE-2018-15152

CVE-2018-15152 affects OpenEMR prior to 5.0.1.4. An unauthenticated bypass of portal/account/register.php lets an attacker access multiple portal endpoints (e.g., add_edit_event_user.php, find_appt_popup_user.php, get_lab_results.php, get_medications.php, get_profile.php, portal_payment.php, mess...

CVE-2018-15155

OS command injection in OpenEMR prior to 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by crafting a request to interfaces/fax/fax_dispatch.php after modifying the hylafax_enscript value in interface/super/edit_globals.php. Affected software: OpenEMR; vulnerable com...

CVE-2018-15152

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access 1 portal/addediteventuser.php, 2 portal/findapptpopupuser.php, 3 portal/getallergies.php, 4 portal/getamendments.php, 5 portal/getlabresults.php, 6...

CVE-2018-15150

CVE-2018-15150 is a SQL injection vulnerability in OpenEMR prior to 5.0.1.4. The flaw resides in interface/de_identification_forms/de_identification_screen2.php, exploitable via the temporary_files_dir parameter in interface/super/edit_globals.php. A remote attacker with prior authentication coul...

CVE-2018-15148

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

CVE-2018-15156

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/faxq.php after modifying the "hylafaxserver" global variable in interface/super/editglobals.php...

CVE-2018-15153

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/main/daemonframe.php after modifying the "hylafaxserver" global variable in interface/super/editglobals.php...

CVE-2018-15147

SQL injection vulnerability in interface/formsadmin/formsadmin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter...

CVE-2018-15154

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/billing/sleobsearch.php after modifying the "printcommand" global variable in interface/super/editglobals.php...

CVE-2018-15148

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

CVE-2018-15152

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access 1 portal/addediteventuser.php, 2 portal/findapptpopupuser.php, 3 portal/getallergies.php, 4 portal/getamendments.php, 5 portal/getlabresults.php, 6...

CVE-2018-15146

SQL injection vulnerability in interface/deidentificationforms/findimmunizationpopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15156

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/faxq.php after modifying the "hylafaxserver" global variable in interface/super/editglobals.php...

CVE-2018-15149

SQL injection vulnerability in interface/forms/eyemag/php/Anythingsimple.php from library/forms.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'encounter' parameter...

CVE-2018-15150

SQL injection vulnerability in interface/deidentificationforms/deidentificationscreen2.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'temporaryfilesdir' variable in interface/super/editglobals.php...

CVE-2018-15155

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/faxdispatch.php after modifying the "hylafaxenscript" global variable in interface/super/editglobals.php...

CVE-2018-15156

OpenEMR prior to 5.0.1.4 is affected by an OS command injection in interface/fax/faxq.php. An authenticated remote attacker can modify the hylafax_server global in interface/super/edit_globals.php and craft a request to execute arbitrary commands. Exploitation details are documented across multip...

CVE-2018-15148

OpenEMR prior to 5.0.1.4 is vulnerable in interface/patient_file/encounter/search_code.php where the text parameter can be leveraged to perform SQL injection, allowing a remote authenticated attacker to execute arbitrary SQL commands. Affected versions: OpenEMR before 5.0.1.4. Root cause: imprope...

CVE-2018-15151

OpenEMR contains a SQL injection vulnerability in interfaces/de_identification_forms/find_code_popup.php prior to 5.0.1.4. An authenticated user can exploit the 'search_term' parameter to execute arbitrary SQL commands, with impact rated as partial confidentiality, integrity, and availability; re...