OpenEMR 6.0.0 Insecure Direct Object Reference

2021.09.01

Credit: Allen Enosh Upputori

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2021-40352

CWE: CWE-532

CVSS Base Score: 4/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8/10

Exploit range: Remote

Attack complexity: Low

Authentication: Single time

Confidentiality impact: Partial

Integrity impact: None

Availability impact: None

# Exploit Title: Openemr 6.0.0 - Insecure direct object references 
# Date: 31/8/2021 
# Exploit Author: Allen Enosh Upputori 
# Vendor Homepage: https://community.open-emr.org 
# Version: 6.0.0 
# Tested on: Linux 
# CVE: 2021-40352 

PoC: An attacker who has Physician Access can read messages with were sent to others members including admin messages the vulnerability exits in the print message feature = "pnotes_print.php?noteid=16" changing the "noteid=" to any other number will reveal the messages of everyone 

https://github.com/allenenosh/CVE-2021-40352 

See this note in RAW Version

Vote for this issue:

100%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

OpenEMR 6.0.0 Insecure Direct Object Reference

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.