CVE-2019-14530 PoC — OpenEMR 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14530.yaml

Associated Vulnerability

Title:OpenEMR 路径遍历漏洞 (CVE-2019-14530)
Description:OpenEMR是OpenEMR社区的一套开源的医疗管理系统。该系统可用于医疗实践管理、电子医疗记录、处方书写和医疗帐单申请。 OpenEMR 5.0.2之前版本中的custom/ajax_download.php文件的‘fileName’参数存在路径遍历漏洞。攻击者可利用该漏洞下载任意文件。

Description

OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.

File Snapshot


 id: CVE-2019-14530

info:
  name: OpenEMR <5.0.2 - Local File Inclusion
  author: TenBird
  severity

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!