CVE-2013-10044

Summary

An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.

Affected Software

Weaknesses

• CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
• https://www.exploit-db.com/exploits/28329
• https://www.exploit-db.com/exploits/28408

References

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
• https://www.exploit-db.com/exploits/28329
• https://www.exploit-db.com/exploits/28408
• https://www.open-emr.org/
• https://github.com/openemr/openemr
• https://www.vulncheck.com/advisories/openemr-sqli-priv-esc-rce

• ←Previous
• Next→