CVSS: 9.1EPSS: 4%CPEs: 1EXPL: 4CVE-2018-15152 – OpenEMR 5.0.1.3 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2018-15152
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient. Vulnerabilidad de omisión de autenticación en portal/account/register.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante remoto acceda a (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php o (15) portal/report/portal_patient_report.php sin autenticarse como un paciente. OpenEMR version 5.0.1.3 suffers from an authentication bypass vulnerability. • https://www.exploit-db.com/exploits/50017 http://packetstormsecurity.com/files/163181/OpenEMR-5.0.1.3-Authentication-Bypass.html https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-15152-Exploit https://github.com/openemr/openemr/pull/1758/files https://insecurity.sh/reports/openemr.pdf https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity https://www.open-emr.org/wiki/index.php/OpenEMR_Patches • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15145
https://notcve.org/view.php?id=CVE-2018-15145
Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) eid, (2) userid, or (3) pid parameter. Múltiples vulnerabilidades de inyección SQL en portal/add_edit_event_user.php en versiones de OpenEMR anteriores a la 5.0.1.4 permiten que un atacante remoto ejecute comandos SQL mediante los parámetros (1) eid, (2) userid o (3) pid. • https://github.com/openemr/openemr/pull/1758/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 70%CPEs: 1EXPL: 7CVE-2018-15139 – OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)
https://notcve.org/view.php?id=CVE-2018-15139
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory. Subida de archivos sin restricción en interface/super/manage_site_files.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante autenticado remoto ejecute código PHP arbitrario subiendo un archivo con una extensión PHP mediante el formulario de subida de imágenes y accediendo a él en el directorio de imágenes. • https://www.exploit-db.com/exploits/49998 https://www.exploit-db.com/exploits/50122 https://github.com/sec-it/exploit-CVE-2018-15139 http://packetstormsecurity.com/files/163110/OpenEMR-5.0.1.3-Shell-Upload.html http://packetstormsecurity.com/files/163482/OpenEMR-5.0.1.3-Shell-Upload.html https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-15139-Exploit https://github.com/openemr/openemr/pull/1757/commits/c2808a0493243f618bbbb3459af23c7da3dc5485 https://www.databreaches.net/openemr-patche • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15144
https://notcve.org/view.php?id=CVE-2018-15144
SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the search_term parameter. Vulnerabilidad de inyección SQL en interface/de_identification_forms/find_drug_popup.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante remoto autenticado ejecute comandos SQL mediante el parámetro search_term. • https://github.com/openemr/openemr/pull/1757/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15141 – OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions
https://notcve.org/view.php?id=CVE-2018-15141
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the "docid" parameter when the mode is set to delete. Salto de directorio en portal/import_template.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante remoto autenticado en el portal patient borre archivos arbitrarios mediante el parámetro "docid" cuando el modo está configurado en delete. OpenEMR version 5.0.1.3 suffers from arbitrary file read, write, and delete vulnerabilities. • https://www.exploit-db.com/exploits/45202 https://github.com/openemr/openemr/pull/1765/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •