Main
Vulnerability Database
Exploits
ID:7080 - Exploit for Arbitrary file upload in OpenEMR - CVE-2018-15139
ID:7080 - Exploit for Arbitrary file upload in OpenEMR - CVE-2018-15139
Published: November 25, 2021
Vulnerability identifier: #VU31238
Vulnerability risk: High
CVE-ID: CVE-2018-15139
CWE-ID: CWE-434
Exploitation vector: Remote access
Vulnerable software:
OpenEMR
OpenEMR
Link to public exploit:
Vulnerability description
The vulnerability allows a remote authenticated user to execute arbitrary code.
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory.
Remediation
Install update from vendor's website.