CVE-2012-2115: SQL Injection
Published Sep 9, 2012
·Updated
SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.
Affected Software
4 affected components
open-emr Openemr<=4.1.0
open-emr Openemr=3.1.0
open-emr Openemr=3.2.0
open-emr Openemr=4.0.0
Event History
Sep 9, 2012
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2115?
CVE-2012-2115 is classified as a medium-severity SQL injection vulnerability.
2
How do I fix CVE-2012-2115?
To fix CVE-2012-2115, upgrade OpenEMR to version 4.1.1 or later where the vulnerability is resolved.
3
Which versions of OpenEMR are affected by CVE-2012-2115?
CVE-2012-2115 affects OpenEMR versions 4.1.0 and earlier, including versions 3.1.0 and 3.2.0.
4
Can CVE-2012-2115 be exploited remotely?
Yes, CVE-2012-2115 can be exploited remotely to execute arbitrary SQL commands.
5
What component of OpenEMR is vulnerable in CVE-2012-2115?
The vulnerable component in CVE-2012-2115 is the interface/login/validateUser.php file.