CVE-2018-15151: SQL Injection

Q: What is the severity of CVE-2018-15151?

CVE-2018-15151 is considered a critical SQL injection vulnerability due to the potential for remote authenticated attackers to execute arbitrary SQL commands.

Q: How do I fix CVE-2018-15151?

To fix CVE-2018-15151, upgrade OpenEMR to version 5.0.1.4 or later where the vulnerability has been patched.

Q: What software is affected by CVE-2018-15151?

CVE-2018-15151 affects OpenEMR versions prior to 5.0.1.4, specifically versions up to and including 5.0.1.3.

Q: Can CVE-2018-15151 be exploited without authentication?

No, CVE-2018-15151 requires remote authenticated access for exploitation.

Q: What type of attack does CVE-2018-15151 enable?

CVE-2018-15151 enables SQL injection attacks, allowing attackers to manipulate database queries through the 'search_term' parameter.

Published Aug 15, 2018

Updated

SQL injection vulnerability in interface/deidentificationforms/findcodepopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter.

Affected Software

1 affected component

open-emr Openemr<=5.0.1.3

Remediation

Patch Available

https://www.open-emr.org/wiki/index.php/OpenEMR_Patches

Event History

Aug 15, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-15151?

CVE-2018-15151 is considered a critical SQL injection vulnerability due to the potential for remote authenticated attackers to execute arbitrary SQL commands.

How do I fix CVE-2018-15151?