Security Alert Fixes

Place to record and track OpenEMR security alerts and their fixes:

• Arbitrary Database Creation/Database Enumeration

• Fixed in most recent 4.0.0 patch and dev version

• Local File Inclusion

• Fixed in most recent 4.0.0 patch and dev version

• Reflected Cross-site Scripting

• This link is dead. Bradymiller 20:04, 30 November 2012 (UTC)

• Security exploit: (Multiple cross-site scripting)

• http://packetstormsecurity.org/files/103810
• There are 4 items here.

• The first two items still exist. A user needs to be authenticated(logged in) into OpenEMR to be able to do this; note a codebase refactoring is currently underway to fix these types of vulnerabilities.
• The last 2 items will be fixed in next 4.1.1 patch and dev version.

The last two are in messages.php which now uses the new security model, so should be fixed. The first two use calendar/index.php which I do not think has been addressed. Note, however, that the provided POC links do not reproduce the vulnerability (meaning I can't reproduce the vulnerabilities).

• Still unable to confirm, but first two calendar items still likely exist. A user needs to be authenticated(logged in) into OpenEMR to be able to do this; note a codebase refactoring is currently underway to fix these types of vulnerabilities.

• Security exploit: (Multiple sql-injection)

• http://secunia.com/advisories/46560/
• There are three items here. The third item has been fixed, however, unsure of the first two.
• The second item has been fixed and committed to the dev branch and is in the most recent 4.1.1 patch.
• The first item likely still exist. A user needs to be authenticated(logged in) into OpenEMR to be able to do this; note a codebase refactoring is currently underway to fix these types of vulnerabilities.

• Security exploit: (One sql-injection)

• http://www.exploit-db.com/exploits/17998
• Fixed in most recent 4.1.0 patch and dev version

• Security exploit: (One sql-injection)

• http://www.mavitunasecurity.com/sql-injection-vulnerability-in-openemr/
• Fixed in most recent 4.1.0 patch and dev version

• Security exploit: (Multiple Local File Inclusion and arbitrary command execution vulnerabilities)

• http://www.htbridge.ch/advisory/HTB23069
• Fixed in most recent 4.1.0 patch and dev version

• Security exploit: (arbitrary file upload vulnerability)

• http://packetstormsecurity.com/files/120274/ZSL-2013-5126.txt
• Fixed in most recent 4.1.1 patch and dev version

• Security exploit: (Multiple Vulnerabilities)

• http://secunia.com/advisories/52145/
• The first item is same as the arbitrary file upload vulnerability item reported above and has been fixed in most recent 4.1.1 patch and dev version.
• The second item still exists. A user needs to be authenticated(logged in) into OpenEMR to be able to do this; note a codebase refactoring is currently underway to fix these types of vulnerabilities.
• The third item is fixed in most recent 4.1.1 patch and dev version.
• The fourth item still exists. A user needs to be authenticated(logged in) into OpenEMR to be able to do this; note a codebase refactoring is currently underway to fix these types of vulnerabilities.
• The fifth item will be fixed in next 4.1.1 patch and dev version.
• The sixth item will be fixed in next 4.1.1 patch and dev version.
• The seventh item is fixed in most recent 4.1.1 patch and dev version.