CVE-2006-5795: High severity OpenEMR OpenEMR vulnerability
Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir parameter to (a) billingprocess.php, (b) billingreport.php, (c) billingreportxml.php, and (d) printbillingreport.php in interface/billing/; (e) login.php; (f) interface/batchcom/batchcom.php; (g) interface/login/login.php; (h) maininfo.php and (i) main.php in interface/main/; (j) interface/new/newpatientsave.php; (k) interface/practice/inssearch.php; (l) interface/logout.php; (m) customreportrange.php, (n) playersreport.php, and (o) frontreceiptsreport.php in interface/reports/; (p) facilityadmin.php, (q) usergroupadmin.php, and (r) userinfo.php in interface/usergroup/; or (s) custom/importxml.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5795?
CVE-2006-5795 has a critical severity rating due to its ability to allow remote attackers to execute arbitrary PHP code.
How do I fix CVE-2006-5795?
To fix CVE-2006-5795, disable register_globals in your PHP configuration and update OpenEMR to a version later than 2.8.1.
What software is affected by CVE-2006-5795?
CVE-2006-5795 affects OpenEMR version 2.8.1 and earlier when register_globals is enabled.
What are the potential impacts of CVE-2006-5795?
Exploitation of CVE-2006-5795 may lead to unauthorized remote code execution and manipulation of the application.
Are there known exploits for CVE-2006-5795?
Yes, there are known exploits for CVE-2006-5795 that target the remote file inclusion vulnerability in the specified PHP scripts.