OpenEMR < 5.0.2 - Path Traversal and Arbitrary File Deletion via fileName Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2019-14530. PoCs published by Ron Jost, sec-it, Wezery. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages a path traversal vulnerability in OpenEMR's custom/ajax_download.php via the fileName parameter, allowing authenticated attackers to read arbitrary files on the server. The script authenticates with provided credentials and constructs a malicious URL to retrieve the specified file.
Description
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
Exploits (3)
This exploit leverages a path traversal vulnerability in OpenEMR's custom/ajax_download.php via the fileName parameter, allowing authenticated attackers to read arbitrary files on the server. The script authenticates with provided credentials and constructs a malicious URL to retrieve the specified file.
This repository contains a functional Ruby exploit for CVE-2019-14530, an authenticated path traversal vulnerability in OpenEMR versions prior to 5.0.2. The exploit leverages a vulnerable endpoint to read arbitrary files on the server, demonstrated by reading /etc/passwd.
This repository provides a detailed technical analysis of CVE-2019-14530, a path traversal and DoS vulnerability in OpenEMR. It explains the vulnerable function, conditions for exploitation, and the impact of the vulnerability, including information disclosure and denial of service.
Nuclei Templates (1)
http.html:"openemr" || http.title:"openemr" || http.favicon.hash:1971268439
icon_hash=1971268439 || body="openemr" || title="openemr" || app="openemr"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H