CVE-2021-32104: SQL Injection

Published May 7, 2021

Updated

A SQL injection vulnerability exists (with user privileges) in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1.

Affected Software

1 affected component

open-emr Openemr=5.0.2.1

Remediation

Patch Available

https://www.open-emr.org/wiki/index.php/Old_Outdated_OpenEMR_Patches

Event History

May 7, 2021

CVE Published

via MITRE·03:50 AM

Data Sourced

via MITRE·03:50 AM

Description

Frequently Asked Questions

What is CVE-2021-32104?

CVE-2021-32104 is a SQL injection vulnerability in OpenEMR 5.0.2.1.

What is the severity of CVE-2021-32104?

CVE-2021-32104 has a severity rating of 8.8 (high).

How can this vulnerability be exploited?

This vulnerability can be exploited by an attacker with user privileges by injecting malicious SQL queries through the save.php file in OpenEMR 5.0.2.1.

How can I fix CVE-2021-32104?

To fix CVE-2021-32104, it is recommended to apply the patches provided by OpenEMR and upgrade to the latest version.

Where can I find more information about CVE-2021-32104?

You can find more information about CVE-2021-32104 on the following references: https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability, https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431, https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592.