Johannes Dahse

Name of the Vulnerable Software and Affected Versions: StackLift LocalStack version 0.12.6 Description: A Cross-site scripting (XSS) issue exists. Recommendations: For version 0.12.6, update to a version that fixes this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient permission assignment checks for a critical resource in the portal/patient/ machine config.php component of OpenEMR. This can allow a remote attacker to gain unauthorized access to protected information. An unauthenticated attacker can exploit this by registering an account and bypassing the permission check of the portal's API, then manipulating and reading data of every registered patient.

Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.2.1 Description: A SQL injection issue exists in the interface/forms/eye mag/save.php file, allowing exploitation with user privileges. Recommendations: For OpenEMR version 5.0.2.1, consider restricting access to the vulnerable save.php file until a patch is available. As a temporary workaround, avoid using user input in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.1 Description: A Stored XSS issue allows an admin authenticated user to inject arbitrary web script or HTML via the `lname` parameter in the interface/usergroup/usergroup admin.php file. Recommendations: For versions prior to 5.0.2.1, update to version 5.0.2.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.2.1 Description: A SQL injection issue exists in the library/custom template/ajax code.php file, allowing exploitation with user privileges. Recommendations: For OpenEMR version 5.0.2.1, consider restricting access to the vulnerable file library/custom template/ajax code.php to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.2.1 Description: The Patient Portal of OpenEMR is affected by a Command Injection issue in the `/interface/main/backup.php` API endpoint. An authenticated attacker can exploit this by sending a POST request that executes arbitrary OS commands via shell metacharacters. Recommendations: For OpenEMR version 5.0.2.1, consider restricting access to the `/interface/main/backup.php` endpoint until a patch is available. As a temporary workaround, limit the functionality of the backup feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

The issue allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive. This occurs when the software is performing a backup or update for an archive and does not properly delete parameters from `$ GET` and `$ POST` when cleansing `$ REQUEST`. Later, it accesses `$ GET` and `$ POST` using the `getQueryParam` function, enabling the exploitation.

The issue allows remote attackers to modify the account settings of arbitrary users. This is achieved via the `customer.customerId` parameter to the "shop/profile/register.action" endpoint.

The issue allows remote attackers to execute arbitrary commands via unspecified vectors when the DebuggingInterceptor component is used in developer mode. The vendor characterizes this behavior as not a security vulnerability itself.

The issue is related to the ParameterInterceptor component, which does not properly restrict access to public constructors. This allows remote attackers to create or overwrite arbitrary files by crafting a parameter that triggers the creation of a Java object. The vulnerability is associated with insufficient access control in the ParameterInterceptor component, enabling remote attackers to write arbitrary files to the system.

The issue is related to the CookieInterceptor component, which does not utilize a parameter-name whitelist. This allows remote attackers to execute arbitrary commands by crafting a specific HTTP Cookie header, triggering Java code execution through a static method. The vulnerability is associated with inadequate access control in the implementation of the CookieInterceptor class.