Published: 13/08/2019 Updated: 10/02/2022

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 535

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

An issue exists in custom/ajax_download.php in OpenEMR prior to 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.

Vulnerable Product	Search on Vulmon	Subscribe to Product
open-emr openemr

OpenEMR version 5017 path traversal exploit ...

OpenEMR version 5013 authenticated remote shell upload exploit that leverages a vulnerability discovered in 2018 ...

OpenEMR version 5017 suffers from a path traversal vulnerability ...

OpenEMR < 5.0.2 - (Authenticated) Path Traversal - Local File Disclosure

OpenEMR CVE-2019-14530 exploit OpenEMR < 502 - (Authenticated) Path Traversal - Local File Disclosure Exploit for CVE-2019-14530 [EDB-50087] [PacketStorm] Usage $ ruby exploitrb -h OpenEMR < 502 - (Authenticated) Path Traversal - Local File Disclosure Source: githubcom/sec-it/exploit-CVE-2019-14530 U

OpenEMR security issue

CVE-2019-14530 Path traversal and DoS vulnerability in OpenEMR project Vulnerable function in file: /openemr/custom/ajax_downloadphp Conditions: any authorized user for DoS case: directory "/sites/default/documents/cqm_qrda/" must exists on server ( Due to logic of "unlink()" function, path to file must consist only exsisting directories and file in it )

OpenEMR < 5.0.1.4 - (Authenticated) File upload - Remote command execution

OpenEMR CVE-2018-15139 exploit OpenEMR < 5014 - (Authenticated) File upload - Remote command execution Exploit for CVE-2018-15139 Usage $ ruby exploitrb -h OpenEMR < 5014 - (Authenticated) File upload - Remote command execution Source: githubcom/sec-it/exploit-CVE-2019-14530 Usage: exploitrb exploit <url> <filename&

CWE-22 https://github.com/openemr/openemr/pull/2592 https://github.com/Wezery/CVE-2019-14530 http://packetstormsecurity.com/files/163215/OpenEMR-5.0.1.7-Path-Traversal.html http://packetstormsecurity.com/files/163375/OpenEMR-5.0.1.7-Path-Traversal.html https://github.com/Hacker5preme/Exploits/tree/main/CVE-2019-14530-Exploit https://nvd.nist.gov https://github.com/sec-it/exploit-CVE-2019-14530 https://packetstormsecurity.com/files/163375/OpenEMR-5.0.1.7-Path-Traversal.html

CVE-2019-14530

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect