CVE-2013-10044: OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-10044?
CVE-2013-10044 is considered a critical vulnerability due to its ability to allow low-privileged attackers to escalate privileges and potentially compromise the system.
How do I fix CVE-2013-10044?
To fix CVE-2013-10044, upgrade OpenEMR to a version higher than 4.1.1 Patch 14 that addresses the authenticated SQL injection vulnerability.
What type of vulnerability is CVE-2013-10044?
CVE-2013-10044 is an authenticated SQL injection vulnerability that allows for the extraction of sensitive information and privilege escalation.
Who is affected by CVE-2013-10044?
CVE-2013-10044 affects OpenEMR versions 4.1.1 and earlier, particularly those using Patch 14.
What can an attacker do with CVE-2013-10044?
An attacker exploiting CVE-2013-10044 can extract administrator credentials, escalate privileges, and perform unauthorized actions such as remote file uploads.