Code injection

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

Directory traversal

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the formname parameter to 1 contrib/acog/printform.php; or 2 loadform.php, 3 viewform.php, or 4 trendform.php in interface/patientfile/encounter...

CVE-2012-0992

OpenEMR 4.1.0 is vulnerable via interface/fax/fax_dispatch.php: the file parameter can be tainted to cause shell command execution. The root cause is improper sanitization of input fed to an exec() call, allowing remote authenticated users to run arbitrary commands. Verified details in multiple s...

CVE-2012-0991

OpenEMR 4.1.0 is affected by multiple directory traversal (LFI) vulnerabilities. The issues arise from unsafely handling the formname parameter in several pages (contrib/acog/print_form.php; interface/patient_file/encounter/load_form.php, view_form.php, and trend_form.php), allowing authenticated...

CVE-2012-0991

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the formname parameter to 1 contrib/acog/printform.php; or 2 loadform.php, 3 viewform.php, or 4 trendform.php in interface/patientfile/encounter...

CVE-2012-0992

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

OpenEMR Local File Include and Command Injection Vulnerabilities

OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user- supplied input. A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the user running the application, obtain potentially...

OpenEMR 4.1.0 LFI and Command Injection Vulnerabilities - Active Check

OpenEMR is prone to local file include LFI and command injection vulnerabilities because it fails to properly sanitize user supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

OpenEMR 4.1.0 Local File Inclusion / Command Execution

Advisory ID: HTB23069 Product: OpenEMR Vendor: OEMR Vulnerable Version: 4.1.0 and probably prior Tested Version: 4.1.0 Vendor Notification: 11 January 2012 Vendor Patch: 29 January 2012 Public Disclosure: 01 February 2012 Vulnerability Type: Local File Inclusion, Arbitrary Command Execution...

OpenEMR 4.1 - contribacogprint_form.php?formname Traversal Local File Inclusion

OpenEMR 4.1 - contribacogprintform.php?formname Traversal Local File Inclusion source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote attacker can exploit...

OpenEMR 4.1 - '/contrib/acog/print_form.php?formname' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the us...

OpenEMR 4.1 - '/Interface/patient_file/encounter/load_form.php?formname' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the us...

OpenEMR 4.1 - Interfacepatient_fileencounterload_form.php?formname Traversal Local File Inclusion

OpenEMR 4.1 - Interfacepatientfileencounterloadform.php?formname Traversal Local File Inclusion source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote...

OpenEMR 4.1 - Interfacefaxfax_dispatch.php?File exec() Call Arbitrary Shell Command Execution

OpenEMR 4.1 - Interfacefaxfaxdispatch.php?File exec Call Arbitrary Shell Command Execution source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote attacker...

OpenEMR 4.1 - Interfacepatient_fileencountertrend_form.php?formname Traversal Local File Inclusion

OpenEMR 4.1 - Interfacepatientfileencountertrendform.php?formname Traversal Local File Inclusion source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote...

OpenEMR 4.1 - '/Interface/patient_file/encounter/trend_form.php?formname' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the us...

OpenEMR 4.1 - '/Interface/fax/fax_dispatch.php?File' 'exec()' Call Arbitrary Shell Command Execution

source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the us...

Multiple vulnerabilities in OpenEMR

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OpenEMR, which can be exploited to perform local file inclusion and arbitrary command execution attacks. 1 Multiple Local File Inclusion vulnerabilities in OpenEMR: CVE-2012-0991 1.1 Input passed via the "formnam...

SQL Injection Vulnerability in OpenEMR 4.1.0

Information -------------------- Name : SQL Injection Vulnerability in OpenEMR Software : OpenEMR 4.1.0 and possibly below. Vendor Homepage : http://www.open-emr.org Vulnerability Type : SQL Injection Severity : Critical Researcher : Canberk Bolat Advisory Reference : NS-12-001 Description...

OpenEMR 4.1.0 SQL Injection

Information -------------------- Name : SQL Injection Vulnerability in OpenEMR Software : OpenEMR 4.1.0 and possibly below. Vendor Homepage : http://www.open-emr.org Vulnerability Type : SQL Injection Severity : Critical Researcher : Canberk Bolat Advisory Reference : NS-12-001 Description...