CVE-2014-5462: SQL Injection
Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layoutid parameter to interface/super/editlayout.php; (2) formpatientid, (3) formdrugname, or (4) formlotnumber parameter to interface/reports/prescriptionsreport.php; (5) paymentid parameter to interface/billing/editpayment.php; (6) id parameter to interface/formsadmin/formsadmin.php; (7) formpid or (8) formencounter parameter to interface/billing/sleobsearch.php; (9) sortby parameter to interface/logview/logview.php; formfacility parameter to (10) procedurestats.php, (11) pendingfollowup.php, or (12) pendingorders.php in interface/orders/; (13) patient, (14) encounterid, (15) formid, or (16) issue parameter to interface/patientfile/deleter.php; (17) searchterm parameter to interface/patientfile/encounter/codingpopup.php; (18) text parameter to interface/patientfile/encounter/searchcode.php; (19) formaddr1, (20) formaddr2, (21) formattn, (22) formcountry, (23) formfreebtype, (24) formpartner, (25) formname, (26) formzip, (27) formstate, (28) formcity, or (29) formcmsid parameter to interface/practice/inssearch.php; (30) formpid parameter to interface/patientfile/problemencounter.php; (31) patient, (32) formprovider, (33) formapptstatus, or (34) formfacility parameter to interface/reports/appointmentsreport.php; (35) dbid parameter to interface/patientfile/summary/demographicssave.php; (36) p parameter to interface/fax/faxdispatchnewpid.php; or (37) patientid parameter to interface/patientfile/reminder/patientreminders.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5462?
CVE-2014-5462 has a medium severity rating due to its potential for SQL injection attacks that can lead to unauthorized data manipulation.
How do I fix CVE-2014-5462?
To fix CVE-2014-5462, upgrade to the latest version of OpenEMR that addresses these SQL injection vulnerabilities.
Who is affected by CVE-2014-5462?
CVE-2014-5462 affects OpenEMR versions 4.1.2 (Patch 7) and earlier, particularly impacting remote authenticated users.
What kind of attacks can CVE-2014-5462 facilitate?
CVE-2014-5462 allows attackers to execute arbitrary SQL commands, potentially compromising the database.
Is there a workaround for CVE-2014-5462 if I can't upgrade?
A temporary workaround for CVE-2014-5462 may involve restricting access to the vulnerable scripts for unauthorized users.