what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution

Posted Sep 20, 2013

Authored by xistence | Site metasploit.com

This Metasploit module exploits a vulnerability found in OpenEMR version 4.1.1 Patch 14 and lower. When logging in as any non-admin user it's possible to retrieve the admin SHA1 password hash from the database through SQL injection. The SQL injection vulnerability exists in the "new_comprehensive_save.php" page. This hash can be used to log in as the admin user. After logging in, the "manage_site_files.php" page will be used to upload arbitrary code.

tags | exploit, arbitrary, php, sql injection

SHA-256 | 153813f0acc368a45adcb43f7156aa643bd4c5305a6564c6562b51d3c58cec74

Download | Favorite | View

Related Files

No related files