OpenEMR < 5.0.1.4 - Authenticated Arbitrary PHP File Upload via Site Files Manager
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2018-15139. PoCs published by Alexandre ZANNI, Ron Jost, sec-it.
AI-analyzed exploit summary This exploit leverages an authenticated file upload vulnerability in OpenEMR to achieve remote code execution by uploading a malicious PHP file. The script logs in as an admin, then uploads a file with a PHP content type to a vulnerable endpoint.
Description
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory.
Exploits (3)
This exploit leverages an authenticated file upload vulnerability in OpenEMR to achieve remote code execution by uploading a malicious PHP file. The script logs in as an admin, then uploads a file with a PHP content type to a vulnerable endpoint.
This exploit demonstrates an authenticated remote code execution vulnerability in OpenEMR versions prior to 5.0.1.4. It uploads a PHP webshell via the 'manage_site_files' interface, allowing arbitrary command execution.
This exploit targets CVE-2018-15139, an authenticated file upload vulnerability in OpenEMR < 5.0.1.4, allowing remote command execution via a malicious PHP file upload. The PoC uses Ruby with HTTPX to authenticate and upload a shell.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H