CVE-2013-10044
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.
| Software | From | Fixed in |
|---|---|---|
| open-emr / openemr | - | 4.1.1.x |
- https://github.com/openemr/openemr
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
- https://www.exploit-db.com/exploits/28329
- https://www.exploit-db.com/exploits/28408
- https://www.open-emr.org/
- https://www.vulncheck.com/advisories/openemr-sqli-priv-esc-rce
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime