NVD

Id
33130  
Name
CVE-2014-5462  
Description
Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number parameter to interface/reports/prescriptions_report.php; (5) payment_id parameter to interface/billing/edit_payment.php; (6) id parameter to interface/forms_admin/forms_admin.php; (7) form_pid or (8) form_encounter parameter to interface/billing/sl_eob_search.php; (9) sortby parameter to interface/logview/logview.php; form_facility parameter to (10) procedure_stats.php, (11) pending_followup.php, or (12) pending_orders.php in interface/orders/; (13) patient, (14) encounterid, (15) formid, or (16) issue parameter to interface/patient_file/deleter.php; (17) search_term parameter to interface/patient_file/encounter/coding_popup.php; (18) text parameter to interface/patient_file/encounter/search_code.php; (19) form_addr1, (20) form_addr2, (21) form_attn, (22) form_country, (23) form_freeb_type, (24) form_partner, (25) form_name, (26) form_zip, (27) form_state, (28) form_city, or (29) form_cms_id parameter to interface/practice/ins_search.php; (30) form_pid parameter to interface/patient_file/problem_encounter.php; (31) patient, (32) form_provider, (33) form_apptstatus, or (34) form_facility parameter to interface/reports/appointments_report.php; (35) db_id parameter to interface/patient_file/summary/demographics_save.php; (36) p parameter to interface/fax/fax_dispatch_newpid.php; or (37) patient_id parameter to interface/patient_file/reminder/patient_reminders.php.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-12-08  
Modified Date
2015-01-02  
Seq
2014-5462  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
173687 33130 CVE-2014-5462 http://packetstormsecurity.com/files/129403/OpenEMR-4.1.2-7-SQL-Injection.html  View
173688 33130 CVE-2014-5462 20141205 CVE-2014-5462 - Multiple Authenticated SQL Injections In OpenEMR  View
173689 33130 CVE-2014-5462 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5462/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16947 JVNDB-2014-005822 OpenEMR における SQL インジェクションの脆弱性 OpenEMR には、SQL インジェクションの脆弱性が存在します。 CVE-2014-5462 72752 CVE-2014-5462 33130 6.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005822.html 2014-11-13 2014-12-10 View