CVE-2021-41843: SQL Injection

Published Dec 17, 2021

Updated

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI.

Affected Software

3 affected components

open-emr Openemr=6.0.0

open-emr Openemr=6.0.0-patch_1

open-emr Openemr=6.0.0-patch_2

Event History

Dec 17, 2021

CVE Published

via MITRE·03:25 AM

Data Sourced

via MITRE·03:25 AM

Description

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-41843?

CVE-2021-41843 is an authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3.

How does CVE-2021-41843 affect OpenEMR?

CVE-2021-41843 allows an attacker to read data from all tables of the database by exploiting the calendar search function with the parameter provider_id.

What is the severity of CVE-2021-41843?

The severity of CVE-2021-41843 is medium with a CVSS score of 6.5.

How can I fix CVE-2021-41843 in OpenEMR?

To fix CVE-2021-41843, you should update OpenEMR to patch version 6.0.0-patch_3 or later.

Where can I find more information about CVE-2021-41843?

You can find more information about CVE-2021-41843 on the following references: [Link 1](http://packetstormsecurity.com/files/165301/OpenEMR-6.0.0-6.1.0-dev-SQL-Injection.html), [Link 2](http://seclists.org/fulldisclosure/2021/Dec/38), [Link 3](https://trovent.github.io/security-advisories/TRSA-2109-01/TRSA-2109-01.txt).