← back
CVE-2018-15141

CVE-2018-15141

EPSS 14.5%
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the "docid" parameter when the mode is set to delete.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/45202/unverifiedexploitdbwww.exploit-db.com/exploits/45202unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/openemr/openemr/pull/1765/fileshttps://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/https://www.exploit-db.com/exploits/45202/