2690 matches found
OpenEMR 4.1.1 Patch 14 - Multiple Vulnerabilities
Exploit Title: OpenEMR 4.1.1 Patch 14 Multiple Vulnerabilities Date: Sep 17 2013 Exploit Author: xistence Vendor Homepage: www.open-emr.org Tested on: CentOS 5.9 32-bit Affected Version : 4.1.1 Patch 14 and lower Fix: Upgrade to OpenEMR 4.1.2 Software details: OpenEMR is a Free and Open Source...
OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution
This module exploits a vulnerability found in OpenEMR version 4.1.1 Patch 14 and lower. When logging in as any non-admin user, it's possible to retrieve the admin SHA1 password hash from the database through SQL injection. The SQL injection vulnerability exists in the "newcomprehensivesave.php"...
CVE-2013-4619
Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 start or 2 end parameter to interface/reports/customreportrange.php, or the 3 formnewid parameter to custom/charttracker.php...
CVE-2013-4620
Cross-site scripting XSS vulnerability in interface/main/onotes/officecommentsfull.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in interface/main/onotes/officecommentsfull.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter...
Sql injection
Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 start or 2 end parameter to interface/reports/customreportrange.php, or the 3 formnewid parameter to custom/charttracker.php...
CVE-2013-4619
Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 start or 2 end parameter to interface/reports/customreportrange.php, or the 3 formnewid parameter to custom/charttracker.php...
CVE-2013-4620
CVE-2013-4620 is an XSS vulnerability in OpenEMR 4.1.1, exploitable via the note parameter in interface/main/onotes/office_comments_full.php. CVSSv2 base score 4.3 (MEDIUM). Affected product/version: OpenEMR 4.1.1 and older patches; impact is injected script/HTML content. Patch-12 (OpenEMR 4.1.1 ...
CVE-2013-4620
Cross-site scripting XSS vulnerability in interface/main/onotes/officecommentsfull.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter...
CVE-2013-4619
Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 start or 2 end parameter to interface/reports/customreportrange.php, or the 3 formnewid parameter to custom/charttracker.php...
CVE-2013-4619
OpenEMR 4.1.1 (patch-12 and earlier) is affected by SQL injection in authenticated areas: (1) interface/reports/custom_report_range.php via start/end, and (2) custom/chart_tracker.php via form_newid. Root cause is insufficient input sanitization, allowing arbitrary SQL execution by authenticated ...
CVE-2013-4620
Cross-site scripting XSS vulnerability in interface/main/onotes/officecommentsfull.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter...
PT-2013-5100
Name of the Vulnerable Software and Affected Versions OpenEMR version 4.1.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the start or end parameter to the "interface/reports/custom report range.php" endpoint, or the form newid...
CVE-2013-4619: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 start or 2 end parameter to interface/reports/customreportrange.php, or the 3 formnewid parameter to custom/charttracker.php...
PT-2013-5101
Name of the Vulnerable Software and Affected Versions OpenEMR version 4.1.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the note parameter in the interface/main/onotes/office comments full.php file...
CVE-2013-4620: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in interface/main/onotes/officecommentsfull.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter...
OpenEMR 4.1.1 patch-12 Cross Site Scripting / SQL Injection
Trustwave SpiderLabs Security Advisory TWSL2013-018: Multiple Vulnerabilities in OpenEMR Published: 07/12/13 Version: 1.0 Vendor: OEMR www.open-emr.org Product: OpenEMR Version affected: 4.1.1 patch-12 and prior Product description: OpenEMR is an ONC-ATB Ambulatory EHR 2011-2012 certified...
OpenEMR 4.1 - note HTML Injection
OpenEMR 4.1 - note HTML Injection source: https://www.securityfocus.com/bid/61154/info OpenEMR is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied...
OpenEMR 4.1 - 'note' HTML Injection
source: https://www.securityfocus.com/bid/61154/info OpenEMR is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and script code to run in the...
