Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also, the original report identified "Open Conference Systems," but this was an error.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
OpenEMR 'Import_XML.PHP'远程文件包含漏洞
Vulnerability Description
OpenEMR 2.8.2版本及其早期版本的interface/globals.php中存在自变量重写漏洞。远程攻击者重写任意程序自变量并执行其他为验证活动,例如(a)可以借助custom/import_xml.php中的srcdir参数执行远程文件包含攻击或(b)可以借助interface/login/login_frame.php的rootdir或可以借助(1)POST和(2)GET超全球数组上的求根操作有关的向量，参数执行跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A