CVE-2013-10044

Katalog CVE

CVSS 8.8 · High EPSS 2,0%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada open-emr openemr. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.

Rincian

Terbit di NVD

1 Agustus 2025

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 79,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/openemr-sqli-priv-esc-rce advisory pihak ketiga
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli... exploit
• https://www.exploit-db.com/exploits/28329 exploit
• https://www.exploit-db.com/exploits/28408 exploit
• https://github.com/openemr/openemr product
• https://www.open-emr.org/ product