CVE-2018-15143: SQL Injection
Published Aug 13, 2018
·Updated
Multiple SQL injection vulnerabilities in portal/findapptpopupuser.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) catid or (2) providerid parameter.
Affected Software
1 affected component
open-emr Openemr<5.0.1.4
Remediation
Patch Available
Event History
Aug 13, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-15143?
CVE-2018-15143 is considered a critical vulnerability due to its potential for remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2018-15143?
To fix CVE-2018-15143, upgrade OpenEMR to version 5.0.1.4 or later.
3
What components are affected by CVE-2018-15143?
CVE-2018-15143 affects the portal/find_appt_popup_user.php file in versions of OpenEMR prior to 5.0.1.4.
4
Can CVE-2018-15143 be exploited remotely?
Yes, CVE-2018-15143 can be exploited remotely by an attacker through specific parameters.
5
What parameters are involved in CVE-2018-15143?
The parameters involved in CVE-2018-15143 are catid and providerid.