CVE-2018-15147: SQL Injection
Published Aug 15, 2018
·Updated
SQL injection vulnerability in interface/formsadmin/formsadmin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter.
Affected Software
1 affected component
open-emr Openemr<=5.0.1.3
Remediation
Patch Available
Event History
Aug 15, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-15147?
CVE-2018-15147 has a high severity rating due to the potential for remote authenticated attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2018-15147?
To fix CVE-2018-15147, upgrade OpenEMR to version 5.0.1.4 or later.
3
Who is affected by CVE-2018-15147?
CVE-2018-15147 affects users of OpenEMR versions prior to 5.0.1.4.
4
What type of vulnerability is CVE-2018-15147?
CVE-2018-15147 is classified as an SQL injection vulnerability.
5
Can CVE-2018-15147 be exploited remotely?
Yes, CVE-2018-15147 can be exploited by remote authenticated attackers.