CyberRota Analysis
AI-GeneratedOpenEMR versions prior to 8.2.0 are vulnerable to a path traversal flaw in the standard_tables_manage.php interface, allowing attackers to manipulate the db GET parameter to execute arbitrary recursive directory deletions. This vulnerability can be exploited in conjunction with an open redirect in dicom_frame.php, enabling unauthenticated attackers to craft malicious URLs that affect authenticated Superuser sessions. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data loss or system disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.