CVE-2018-15139: Malicious File Upload
Unrestricted file upload in interface/super/managesitefiles.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15139?
CVE-2018-15139 is considered a high-severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2018-15139?
To fix CVE-2018-15139, upgrade OpenEMR to version 5.0.1.4 or later which mitigates this vulnerability.
Who is affected by CVE-2018-15139?
CVE-2018-15139 affects all versions of OpenEMR prior to 5.0.1.4.
What type of vulnerability is CVE-2018-15139?
CVE-2018-15139 is an unrestricted file upload vulnerability that allows execution of arbitrary PHP code.
Can CVE-2018-15139 be exploited remotely?
Yes, CVE-2018-15139 can be exploited remotely by an authenticated attacker to upload malicious files.