CVE-2013-4619: SQL Injection
Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/customreportrange.php, or the (3) formnewid parameter to custom/charttracker.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4619?
CVE-2013-4619 has a medium severity rating due to its potential to allow authenticated users to perform SQL injection attacks.
How do I fix CVE-2013-4619?
To fix CVE-2013-4619, update OpenEMR to a version that has patched these SQL injection vulnerabilities.
Who is affected by CVE-2013-4619?
CVE-2013-4619 affects users of OpenEMR version 4.1.1 who have access to specific reporting functionalities.
What types of attacks can CVE-2013-4619 enable?
CVE-2013-4619 can enable attackers to execute arbitrary SQL commands on the database.
Can CVE-2013-4619 be exploited remotely?
Yes, CVE-2013-4619 can be exploited by remote authenticated users through specific input parameters.