Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-10044

An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.

Published

2025-08-01T21:15:26.030

Last Modified

2025-11-26T14:10:49.937

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

Weaknesses

Type: Secondary
CWE-89
CWE-434
Type: Primary
CWE-434

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	open-emr	openemr	≤ 4.1.1	Yes

References

https://github.com/openemr/openemr Product ([email protected])
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb Exploit ([email protected])
https://www.exploit-db.com/exploits/28329 Exploit ([email protected])
https://www.exploit-db.com/exploits/28408 Exploit ([email protected])
https://www.open-emr.org/ Product ([email protected])
https://www.vulncheck.com/advisories/openemr-sqli-priv-esc-rce Third Party Advisory ([email protected])
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb Exploit (134c704f-9b21-4f2e-91b3-4a467353bcc0)
https://www.exploit-db.com/exploits/28329 Exploit (134c704f-9b21-4f2e-91b3-4a467353bcc0)
https://www.exploit-db.com/exploits/28408 Exploit (134c704f-9b21-4f2e-91b3-4a467353bcc0)