Authenticated SQL Injection in OpenEMR before

Overview :
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
Affected Product(s) :
  • OpenEMR 5.0.1
  • OpenEMR
  • OpenEMR
  • OpenEMR
  • OpenEMR
  • OpenEMR
  • OpenEMR
  • OpenEMR
  • OpenEMR 5.0.2
Vulnerability Details :
CVE ID : CVE-2019-16404
If the OpenEMR instance was running on localhost port 80, the following URL could be used to exploit the vulnerability, executing the payload “version()”.


Note that this would require there to be no existing providerID 1 present in the database. After retrieving the cell of data, the next cell retrieved would have to use a new provider id, since this also has the affect of adding data with the provderID.

Solution :

Fixed-In Version:

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2022-AVAST2 : Self-Defense Bypass via Repairing Function

Description It was noted that there is security checking to prevent some of the Avast processes from loading of undesired/unsigned

CVE-2022-21500 : Oracle Security Alert Advisory

Description This Security Alert addresses vulnerability CVE-2022-21500, which affects some deployments of Oracle E-Business Suite. This vulnerability is remotely exploitable

CVE-2022-1183 : Destroying a TLS session early causes assertion failure

Description On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those