CVE-2013-10044

An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.

Affected products

Openemr

Open-emr Openemr

≤ 4.1.1

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

1.4% (70th percentile)

Weakness

CWE-434, CWE-89

NVD status

Analyzed

Published

2025-08-01

Attack patterns

CAPEC-137

Entry point

form_pubpid request body

Path

interface/new/new_comprehensive_save.php