CVE-2013-10044 Details

A SQL injection vulnerability has been identified in OpenEMR versions through 4.1.1 Patch 14. This vulnerability allows a low-privileged authenticated user to inject SQL and extract sensitive information, such as administrator password hashes, from the database. Once the attacker obtains the admin password hash, they can log in as an admin user. After gaining administrative privileges, the attacker can exploit an unrestricted file upload vulnerability to upload malicious files, such as PHP scripts, which can be executed on the server, leading to a full compromise of the application and the host system.

Users are advised to upgrade to OpenEMR version 4.1.2 or later.