Exploitation Summary
EIP tracks 2 public exploits for CVE-2011-5160. PoCs published by Level, AutoSec Tools.
AI-analyzed exploit summary The exploit demonstrates an arbitrary file upload vulnerability in OpenEMR 4, allowing an attacker to upload a malicious shell via the Patient Photograph feature. It also includes examples of XSS and SQL injection vulnerabilities in the same software.
Description
Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter.
Exploits (2)
The exploit demonstrates an arbitrary file upload vulnerability in OpenEMR 4, allowing an attacker to upload a malicious shell via the Patient Photograph feature. It also includes examples of XSS and SQL injection vulnerabilities in the same software.
The exploit demonstrates a Local File Inclusion (LFI) vulnerability in OpenEMR 4.0.0, allowing arbitrary file inclusion via path traversal. It also includes proofs for arbitrary database creation and reflected XSS vulnerabilities.