CVE-2019-16404: SQL Injection
Published Oct 21, 2019
·Updated
Authenticated SQL Injection in interface/forms/eyemag/js/eyebase.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
Affected Software
1 affected component
open-emr Openemr>=5.0.1<=5.0.2
Event History
Oct 21, 2019
CVE Published
via MITRE·10:14 PM
Data Sourced
via MITRE·10:14 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16404?
CVE-2019-16404 is rated with a medium severity due to its potential for SQL injection vulnerabilities in OpenEMR.
2
How do I fix CVE-2019-16404?
To fix CVE-2019-16404, upgrade OpenEMR to version 5.0.3 or later where this vulnerability has been addressed.
3
What type of vulnerability is CVE-2019-16404?
CVE-2019-16404 is an authenticated SQL injection vulnerability affecting specific versions of OpenEMR.
4
Which software versions are affected by CVE-2019-16404?
CVE-2019-16404 affects OpenEMR versions from 5.0.1 up to 5.0.2.
5
Can CVE-2019-16404 lead to data theft?
Yes, CVE-2019-16404 allows unauthorized users to extract arbitrary data from the OpenEMR database.