medium6.8Public exploit code
CVE-2011-5161
Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OpenEMR 4 - Multiple Vulnerabilities2011-12-25 · webapps · php
Impact
Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient directory under documents/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Open-Emr | Openemr | Versions 4.0.0, 4.1.0, 4.1.1 |