A vulnerability classified as critical was found in OpenEMR up to 5.0.1 Patch 6 (Business Process Management Software). This vulnerability affects the function make_task of the file /interface/forms/eye_mag/php/taskman_functions.php. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.

The weakness was disclosed 05/17/2019. This vulnerability was named CVE-2018-17179 since 09/18/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

By approaching the search of inurl:interface/forms/eye_mag/php/taskman_functions.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 5.0.1 Patch 7 is able to eliminate this problem.

The entries VDB-135174 and VDB-135173 are pretty similar.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 5.0.1 Patch 6

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion