CVE-2018-9250: SQL Injection
Published May 18, 2018
·Updated
interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.
Affected Software
1 affected component
open-emr Openemr<5.0.1.1
Remediation
Event History
May 18, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-9250?
CVE-2018-9250 has a high severity rating due to its potential for remote SQL command execution by authenticated users.
2
How do I fix CVE-2018-9250?
To fix CVE-2018-9250, upgrade to OpenEMR version 5.0.1.1 or later.
3
What kind of attacks can be performed due to CVE-2018-9250?
CVE-2018-9250 allows attackers to execute arbitrary SQL commands, leading to possible data manipulation or extraction.
4
Who is affected by CVE-2018-9250?
Users of OpenEMR versions prior to 5.0.1.1 are affected by CVE-2018-9250.
5
Is authentication required to exploit CVE-2018-9250?
Yes, CVE-2018-9250 requires authenticated access to exploit the vulnerability.