CVE-2021-41843

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the…

published December 17, 2021

CVSS

—

EPSS

13%

Percentile

96.2

In the wild

Unconfirmed

What it is

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.12655 · 96.2th percentile
Published: 2021-12-17T03:25Z

EPSS history

Timeline

17 DEC 03:25Z
An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the…
cvelistv5