CVE-2021-40352 PoC — OpenEMR 日志信息泄露漏洞

Source

https://github.com/allenenosh/CVE-2021-40352

Associated Vulnerability

Title:OpenEMR 日志信息泄露漏洞 (CVE-2021-40352)
Description:OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.

Readme

# CVE-2021-40352
Opnemr Version 6.0.0 
Has a security vulnerability where an attacker who has Physician Access can read messages with were sent to others members including admin messages

the vulnerability exits in the print message feature = "pnotes_print.php?noteid=16"

changing the "noteid=" to any other number will reveal the messages of everyone 

Discovered by Allen Enosh Upputori , September 2021 .


CVE issued 31/08/2021

Check the CVE listed here : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40352.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →