CVE-2021-32104: SQL Injection
First published: Fri May 07 2021(Updated: )
A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-emr Openemr | =5.0.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability
- https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
- https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592
- https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
- https://www.open-emr.org/wiki/index.php/Old_Outdated_OpenEMR_Patches
Frequently Asked Questions
What is CVE-2021-32104?
CVE-2021-32104 is a SQL injection vulnerability in OpenEMR 5.0.2.1.
What is the severity of CVE-2021-32104?
CVE-2021-32104 has a severity rating of 8.8 (high).
How can this vulnerability be exploited?
This vulnerability can be exploited by an attacker with user privileges by injecting malicious SQL queries through the save.php file in OpenEMR 5.0.2.1.
How can I fix CVE-2021-32104?
To fix CVE-2021-32104, it is recommended to apply the patches provided by OpenEMR and upgrade to the latest version.
Where can I find more information about CVE-2021-32104?
You can find more information about CVE-2021-32104 on the following references: https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability, https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431, https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/open-emr
- canonical/open-emr openemr
- version/open-emr openemr/5.0.2.1